Skip to content

Firewall

Custom firewall rules

Pro and AgencyAbout Firewall

Your own if-this-then-that rules for incoming requests: block, allow or just log requests that match a page address, a browser name, a visitor address and more.

What it does

Each rule has one or more conditions, such as "the page address contains .git", and an action: Block Request, Allow Request or Log Only.

Conditions can look at the full address, the path, the query string, the request method, the user agent, the referring page, the visitor address, the host name, any request header or any submitted form field.

Presets add ready-made rules in one click, such as blocking access to wp-config.php, .htaccess and .git, known bad robots, common SQL injection attempts and requests with no user agent.

Why it matters

Every site is different. Rules let you shut a door the other features do not know about, such as an old page robots keep probing, without touching server configuration.

Set it up

  1. Go to the Firewall tab, section Firewall rules, and switch on Custom Firewall Rules.
  2. Add a preset, or create a rule: give it a name, add conditions, choose whether ALL or ANY must match, and pick the action.
  3. Try a new rule as Log Only first and check the activity log for a day, to be sure it only catches what you meant.
  4. Change it to Block Request when you are happy. Each rule card shows how often it matched today and over 30 days.

Good to know

Rules run in priority order, lowest number first. A Block or Allow match stops further rules; Log Only carries on.

Blocked requests see a 403 page with your Default Block Message, or your theme's 404 page.

Administrators inside the admin area and allow-listed addresses skip the rules.

Which plan includes it

Custom firewall rules and their hit counts are part of Pro.

How it works, for developers
  • Rules are evaluated on init at priority 3, skipping AJAX and scheduled tasks. Operators: contains, does not contain, equals, does not equal, starts with, ends with, regex, not regex, IP matches (CIDR or wildcard), empty, not empty.
  • Regular expressions are limited to 500 characters and checked for patterns that could hang the server.
  • Rules are stored in the option smg_firewall_rules; hit counts for 30 days in smg_firewall_rules_stats. Every match is written to the activity log, and smg_firewall_block fires at most once an hour per address and rule for alerts.
  • Settings: smg_firewall_rules_enabled, smg_firewall_rules_message. Skipped while SMG_SAFE_MODE is defined.

Quick answers about custom firewall rules

What does Custom firewall rules do in Stack Guard?

Each rule has one or more conditions, such as "the page address contains .git", and an action: Block Request, Allow Request or Log Only. Conditions can look at the full address, the path, the query string, the request method, the user agent, the referring page, the visitor address, the host name, any request header or any submitted form field. Presets add ready-made rules in one click, such as blocking access to wp-config.php, .htaccess and .git, known bad robots, common SQL injection attempts and requests with no user agent.

Why use custom firewall rules on a WordPress site?

Every site is different. Rules let you shut a door the other features do not know about, such as an old page robots keep probing, without touching server configuration.

How do I set up custom firewall rules?

1. Go to the Firewall tab, section Firewall rules, and switch on Custom Firewall Rules. 2. Add a preset, or create a rule: give it a name, add conditions, choose whether ALL or ANY must match, and pick the action. 3. Try a new rule as Log Only first and check the activity log for a day, to be sure it only catches what you meant. 4. Change it to Block Request when you are happy. Each rule card shows how often it matched today and over 30 days.

Which Stack Guard plan includes custom firewall rules?

Custom firewall rules and their hit counts are part of Pro.

More in Firewall

Not running Stack Guard yet? It is free.

Download Free