NinjaFirewall WP+ Edition

NinjaFirewall WP+ Edition is a stand-alone web application firewall installed as a WordPress add-on. It can hook, scan, sanitise, or reject HTTP and HTTPS requests before they reach WordPress or its extensions. Coverage includes PHP scripts in the blog installation directories and subdirectories, including scripts outside the WordPress package. The filtering engine normalizes and transforms request data to help detect evasion and obfuscation techniques, supports and decodes a broad set of encodings, and can filter encoded PHP scripts, shell scripts, and backdoors.

Controls for traffic, documents, and logs

• Set access controls by IP address, visitor role, country, URL, or bot classification.
• Protect wp-login.php against brute-force attacks, with the option to extend protection to xmlrpc.php. Incidents can also be written to the server AUTH log.
• Use rate limiting to block aggressive bots, crawlers, web scrapers, and HTTP attacks. Add antispam protection for comment and user registration forms.
• Scan HTML output just before it is sent to a visitor's browser with response body filtering.
• File Guard can detect access to recently created or modified PHP files and alert you with the script name, IP address, request, date, and time.
• File Check can scan the website hourly, twice daily, or daily to detect file modifications.
• Use centralized logging, improved log management, and Syslog logging.
• Import and export configuration from WP-CLI, manage file uploads, and use Unix shared memory for inter-process communication.

Requirements and administration

The WP+ Edition requires WordPress 4.9 or later, PHP 7.1 or later, and MySQL or MariaDB with the MySQLi extension. Supported web servers are Apache, Nginx, LiteSpeed, and OpenLiteSpeed. The operating system must be Unix-like, such as Linux or BSD; Microsoft Windows is not compatible. Installation and administration require an administrator or superadministrator with manage_options and unfiltered_html capabilities.

Install the extension and activate it through the WordPress Plugins menu, then configure the firewall in its administration screens. Each menu page includes contextual help. The interface uses WordPress styling and is smartphone-friendly.