Inspection before WordPress

NinjaFirewall WP+ Edition is a stand-alone web application firewall installed and configured as a WordPress plugin. It can hook, scan, sanitise, or reject HTTP and HTTPS requests before they reach WordPress or its add-ons. Its coverage includes PHP scripts throughout the blog installation directories and subdirectories, including scripts outside the WordPress package.

To help identify evasion techniques and obfuscation, the filtering engine normalizes and transforms incoming request data. It supports and decodes a broad set of encodings, and can filter encoded PHP scripts, hacker shell scripts, and backdoors.

Traffic and login controls

• Set access controls by IP address, visitor role, country, URL, or bot classification.
• Protect wp-login.php against brute-force attacks, including distributed attempts involving many IP addresses. Protection can also extend to xmlrpc.php. Incidents can be written to the server AUTH log.
• Use rate limiting to block aggressive bots, crawlers, web scrapers, and HTTP attacks.
• Add antispam protection for comment and user registration forms.

File and response monitoring

The response body filter scans HTML output just before it is sent to a visitor’s browser. File Guard can detect access to a recently created or modified PHP file and alert you with the script name, IP address, request, date, and time. File Check scans the website hourly, twice daily, or daily to detect file modifications.

Logs and administration

WP+ Edition includes centralized logging, improved log management, and Syslog logging. Administrators can import or export the configuration from WP-CLI and use improved file upload management. Unix shared memory handles inter-process communication.

The administration interface uses the WordPress interface, includes contextual help on each menu page, and is smartphone-friendly. It has no intrusive banners, warnings, or flashy colors.

Requirements and installation

WP+ Edition requires WordPress 4.9 or later, PHP 7.1 or later, and MySQL or MariaDB with the MySQLi extension. Installation requires an administrator or superadministrator with manage_options and unfiltered_html capabilities. Supported web servers are Apache, Nginx, LiteSpeed, and OpenLiteSpeed. The operating system must be Unix-like, such as Linux or BSD; Microsoft Windows is not compatible.

Install NinjaFirewall WP+ Edition as a WordPress extension, activate it through the Plugins menu, then open the NinjaFirewall administration screens to configure the firewall and review contextual help. Set access controls, logging, rate limiting, file monitoring, and other available settings for the website.