May 20, 2014 by Paul G. | Migrated, Shield Security

Part 3: WordPress Firewall – Shield Security Plugin for WordPress

Shield Image

The Firewall module is just one part of the whole Shield security system.

In this part of the series we’ll detail what exactly the firewall is, what it does, how it works, and how you should configure it.

What is the WordPress Firewall and how does it work?

The firewall component of the plugin is an Application Level Firewall.

This means it only acts, and can only act, at the WordPress level. It does not, and cannot ever, affect lower levels on the server. It can never block incoming connections from IP addresses and/or to ports on the server.  No WordPress plugin can do this.

No WordPress plugin can do this, no matter what they tell you.

We don’t write to the core .htaccess files on principle, so we don’t affect how Apache handles web requests. Instead, we examine the data in these requests and then allow or block WordPress from loading depending on the rules you have chosen.

The plugin analyses the information contained within the GET and POST data sent to your site. This is explained in more detail here.

When it detects something that it doesn’t like – it’ll kill that web request and prevent WordPress from loading any further.

In this way, it prevents WordPress from receiving/using malicious data that’s been sent to it to for the purpose of causing trouble.

Understanding the WordPress Firewall options

The firewall component of the plugin has a number of options associated with it. Below is an outline of these to help better understand each section:

Firewall Block Response

This option specifies how the plugin will respond when the firewall detects malicious data.

WordPress Firewall Block Response Options

You have 4 possible responses:

  • [default] kill the running PHP process and display a friendly message
  • immediately kill the running PHP process
  • redirect the web request to a 404 page
  • redirect the web request to the homepage

Whichever you choose is down to your personal preference. We recommend the first one (the default) so that in the case a legitimate visitor trips the firewall with a false positive, it can be more easily identified and reported.

Send Email Report: This option, when enabled will send the administrator an email notifying them of a firewall block incident.


We recommend to keep this turned off. There is just no need to bother with these notices. It’s useful however when you are debugging the firewall when you suspect interference with/from other plugins.


Firewall White Listing and Ignore Options

It’s possible to specify certain factors that completely by-pass all Firewall checking.

These options should be used sparingly and with caution since you never want to white list anyone, even yourself, unless you really must.

Shield Plugin: Firewall White List Settings

Whitelist Parameters: This is an advanced setting where you can by-pass the firewall for a given page such as ‘hello.php’, or by-pass the firewall for a given parameter sent to that page. This is useful where certain pages/plugins submit data that you always want to leave untouched by the firewall.

Ignore Administrators: This is not a recommended option, but if you want to ensure that administrators are never affected by the firewall, turn this option on.

In general, there is no need to white list anything unless there is a compatibility issue to deal with.


Firewall Blocking Options

There are 9 firewall options that determine what data is checked on each page request. Depending on certain incompatibilities with other plugins, you may need to disable certain options to ensure maximum compatibility.

WordPress Firewall Settings

Here are just a few of them:

Include Cookies: Default – Off. This is a throwback to the ‘WordPress Firewall 2’ plugin. As mentioned earlier, the firewall examines the data with GET and POST, but with this option enabled, you can also have it check the site cookies.

Directory Traversals: Default – On. There is typically no need for file paths that indicates attempts to move between directories on the filesystem. Be careful, as this might interfere with sites that publish content containing code snippets – it might be an idea to use the “ignore administrators” option mentioned above.

WordPress Terms: Default – Off. Malicious requests might try and reference common WordPress terms in their attacks – this option ensures that some of the most common terms are restricted. If any option is likely to interfere with normal operations, it’s probably this one.

Field Truncation: Default – On. Much like file system traversals, you typically shouldn’t have SQL queries in data submitted to your site. This option will try to look for keywords and patterns associated with SQL queries.

PHP Code: Default – Off. Again, just like SQL, WordPress terms etc., you typically shouldn’t have PHP code in data submitted to your site. If you use the plugins/themes editor, this might trip the Firewall checks.

Exe File Uploads: Default – Off. When files are uploaded to your site, it looks for executable file extensions such as .dll, .php, .exe, .py etc.

Leading Schemas: Default – Off. This option looks for things like “http://” and “https://” and it the option most likely to cause issues.


WordPress Firewall Feature Summary

As you can see, Shield’s Firewall component is full-featured and easily customized to fit as many site configurations as possible.

Firewall checking begins right after all site plugins are loaded and before WordPress really begins to kick-off. Of course, adding all this checking to every page request adds extra processing, but we’ve written the firewall component (just like the rest) to be as efficient as possible and to only scan where there is data to process.

If you have any questions about the firewall, or wish to request some features, please drop us a message in the comments section below, or contact us in our support centre.

ShieldPRO Testimonials
@norus's Gravatar @norus

Nice and practical plugin easy install

does what it should do!

@georgeinmexico's Gravatar @georgeinmexico

One of the only free Yubi-key options

I have really appreciated the Yubi-key two factor authentication feature of this plugin. I also thought the initial setup wizard was really well done. The setup wizard made me feel like my site was in good hands.

@jedijonny's Gravatar @jedijonny

Got Notified!

I had previously been attacked and thought I had removed everything, but sure enough, a dormant malware script altered 3 of my files but instead of not finding out about it until later when Google would flag my site, I got an email notification that 3 of my wordpress files…

@nickfmc's Gravatar @nickfmc

all the best parts of other plugins

This Plugin takes the place of 4 other security plugins I was using in a super lightweight package! Also makes auto updates super easy to manage! Something we should all be doing these days

Hey there good-lookin'! Do you like what you've read here? :)

If this cool feature is something you'd like, but you haven't gone PRO yet, click here to get started today. (no risk, with a 14-day satisfaction guarantee!)

You'll get all PRO features, including Malware Scanning, WP Config Protection, Plugin FileGuard, import/export, customer support, and so much more. Not only that, you'll get that warm, fuzzy feeling that comes from supporting our work and future development.

Follow Your Dreams (and go pro) →

Comments (5)

    I have used Jetpack to secure my website. Is my website still need a Firewall plugin such as iControlWP? I’m sorry if you find any mistakes in my English.

      JetPack is not a security plugin… there is a lot of functionality supplied within Shield that is not provided in JetPack – they are 2 totally different plugins.
      Thanks!

    Any idea why navigating to this page: http://askwpgirl.com/how-do-i-set-up-rss-feeds-on-my-wordpress-website/ from a google search got me blacklisted?

    will be better if ishield will have a 404 error blocking system as wordfence and ithemes – so if someone hit many 404 error in a short time to be blocked

      Hi George,

      Shield does have this option – you’ll find it under the IP Manager module. It is a Pro-only feature so you’ll need to upgrade to access it. But at $12/year, it’s not a lot… and you get all the other Pro extras too 🙂

      Thanks,
      Paul.

Leave a Reply to Paul G. Cancel reply

Your email address will not be published. Required fields are marked *

Click to access the login or register cheese