This plugin hasn’t been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.

WordPress Firewall


This WordPress plugin investigates web requests with simple WordPress-specific heuristics to identify and stop most obvious attacks. There exist a few powerful generic modules that do this; but they’re not always installed on web servers, and difficult to configure.

It intelligently whitelists and blacklists pathological-looking phrases based on which field they appear within in a page request (unknown/numeric parameters vs. known post bodies, comment bodies, etc.). Its purpose is not to replace prompt and responsible upgrading, but rather to mitigate 0-day attacks and let bloggers sleep better at night.

WordPress Firewall Info and
WordPress Firewall Security Filters for more information.


  • Screenshot 1 (screenshot-1.gif).
  • Screenshot 2 (screenshot-2.gif).


  1. Copy the contained program to “wordpress-firewall.php” within your “wp-content/plugins/” folder.


Installation Instructions
  1. Copy the contained program to “wordpress-firewall.php” within your “wp-content/plugins/” folder.
What does this thing actually do?

Lots of stuff – here’s the list:

  • Detect, intecept, and log suspicious-looking parameters — and prevent them compromising WordPress.
  • Also protect most WordPress plugins from the same attacks.
  • Optionally configure as the first plugin to load for maximum security.
  • Respond with an innocuous-looking 404, or a home page redirect.
  • Optionally send an email to you with a useful dump of information upon blocking a potential attack.
  • Turn on or off directory traversal attack detection.
  • Turn on or off SQL injection attack detection.
  • Turn on or off WordPress-specific SQL injection attack detection.
  • Turn on or off blocking executable file uploads.
  • Turn on or off remote arbitrary code injection detection.
  • Add whitelisted IPs.
  • Add additional whitelisted pages and/or fields within such pages to allow above to get through when desirable.



works well on an old 2.9.2 install, together with WPML (3 languages) and a lot of other plugins.

Read all 4 reviews

Contributors & Developers

“WordPress Firewall” is open source software. The following people have contributed to this plugin.


Translate “WordPress Firewall” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.



  • First release.


  • Unreleased.