NinjaFirewall WP+ Edition

Inspection before WordPress

NinjaFirewall WP+ Edition is a stand-alone web application firewall installed and configured as a WordPress extension. It can hook, scan, sanitise, or reject HTTP and HTTPS requests before they reach WordPress or its extensions. Its coverage includes PHP scripts throughout the blog installation directories and subdirectories, including scripts outside the WordPress package.

To help identify evasion techniques and obfuscation, the filtering engine normalizes and transforms incoming request data. It works with and decodes a broad set of encodings, and can filter encoded PHP scripts, hacker shell scripts, and backdoors.

Traffic and login controls

• Set access controls by IP address, visitor role, country, URL, or bot classification.
• Protect wp-login.php against brute-force attacks, including distributed attempts involving many IP addresses. Protection can also extend to xmlrpc.php. Incidents can be written to the server AUTH log.
• Use rate limiting to block aggressive bots, crawlers, web scrapers, and HTTP attacks.
• Add antispam protection for comment and user registration forms.

File and response monitoring

The response body filter scans HTML output just before it is sent to a user’s browser. File Guard can detect access to a recently created or modified PHP file and alert you with the script name, IP address, request, date, and time. File Check scans the website hourly, twice daily, or daily to detect file modifications.

Logs and administration

WP+ Edition includes centralized logging, improved log management, and Syslog logging. Administrators can import or export the configuration from WP-CLI and use improved file upload management. Unix shared memory handles inter-process communication.

The administration interface uses the WordPress interface, provides contextual help on each menu page, and is smartphone-friendly. It has no intrusive banners, warnings, or flashy colors.

Requirements and installation

WP+ Edition requires WordPress 4.9 or later, PHP 7.1 or later, and MySQL or MariaDB with the MySQLi extension. Installation requires an administrator or superadministrator with manage_options and unfiltered_html capabilities. Supported web servers are Apache, Nginx, LiteSpeed, and OpenLiteSpeed. The operating system must be Unix-like, such as Linux or BSD; Microsoft Windows is not compatible.

Install NinjaFirewall WP+ Edition as a WordPress plugin, activate it through the Plugins menu, then open the NinjaFirewall administration screens to configure the firewall and review contextual help. Set access controls, logging, rate limiting, file monitoring, and other available settings for the site.