{"id":13549038,"url":"https://github.com/szepeviktor/waf4wordpress","last_synced_at":"2025-04-08T03:11:29.784Z","repository":{"id":34850075,"uuid":"38844106","full_name":"szepeviktor/waf4wordpress","owner":"szepeviktor","description":"WAF for WordPress 🔥 with 60+ security checks and weekly updates","archived":false,"fork":false,"pushed_at":"2024-07-10T20:37:57.000Z","size":459,"stargazers_count":131,"open_issues_count":7,"forks_count":26,"subscribers_count":17,"default_branch":"master","last_synced_at":"2025-03-31T17:18:32.596Z","etag":null,"topics":["fail2ban","firewall","plugin","security","waf","wordpress","wordpress-security"],"latest_commit_sha":null,"homepage":"https://github.com/szepeviktor/wordpress-website-lifecycle","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/szepeviktor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"szepeviktor"}},"created_at":"2015-07-09T20:39:58.000Z","updated_at":"2025-03-30T00:41:59.000Z","dependencies_parsed_at":"2024-08-03T13:46:01.627Z","dependency_job_id":null,"html_url":"https://github.com/szepeviktor/waf4wordpress","commit_stats":{"total_commits":194,"total_committers":2,"mean_commits":97.0,"dds":0.005154639175257714,"last_synced_commit":"ad4af77d3ae135fcbaae5582370f413093834968"},"previous_names":[],"tags_count":59,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/szepeviktor%2Fwaf4wordpress","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/szepeviktor%2Fwaf4wordpress/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/szepeviktor%2Fwaf4wordpress/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/szepeviktor%2Fwaf4wordpress/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/szepeviktor","download_url":"https://codeload.github.com/szepeviktor/waf4wordpress/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247767236,"owners_count":20992548,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fail2ban","firewall","plugin","security","waf","wordpress","wordpress-security"],"created_at":"2024-08-01T12:01:17.574Z","updated_at":"2025-04-08T03:11:29.767Z","avatar_url":"https://github.com/szepeviktor.png","language":"PHP","funding_links":["https://github.com/sponsors/szepeviktor"],"categories":["PHP"],"sub_categories":[],"readme":"# WAF for WordPress\n\n[![License][src-packagist-license]][href-license-file]\n[![PHP Version][src-php-version]][href-composer-file]\n[![Packagist stats][src-packagist-downloads]][href-packagist-stats]\n[![Latest version][src-latest-version]][href-packagist]\n[![PHPStan enabled][src-phpstan-enabled]][href-phpstan-org]\n\nStop real-life attacks on your WordPress website and\ntrigger [Fail2Ban](https://github.com/fail2ban/fail2ban).\n\n:bulb: Before using this WAF you have to clean your website, get rid of even tiny errors.\nSee your access and error logs daily and run this WAF without Fail2ban for a week.\n\nThis WAF does not give proper HTTP responses to unusual requests.\nIt blocks the attacking IP address instantly, the purpose of this are the following.\n\n1. Prevent website compromise in further requests\n1. Prevent DoS attacks\n\nShared hosting has no server-wide banning (because of trust issues)\nbut you can still install this software without Fail2Ban to stop attacks by using one of the Miniban methods.\n\n## Support my work\n\nPlease consider sponsoring me monthly if you use my packages in an agency.\n\n[![Sponsor](https://github.com/szepeviktor/.github/raw/master/.github/assets/github-like-sponsor-button.svg)](https://github.com/sponsors/szepeviktor)\n\n## Theory\n\nYour WordPress - really general HTTP - security consists of the followings.\n\n1. Use HTTPS\n1. Have daily backups\n1. Block [known hostile networks](https://github.com/szepeviktor/debian-server-tools/tree/master/security/myattackers-ipsets)\n1. Have Fail2Ban installed (controls the firewall)\n1. Maintain your website and use\n   [strict Fail2Ban filters](https://github.com/szepeviktor/debian-server-tools/tree/master/security/fail2ban-conf)\n   which ban on the first suspicious request instantly\n1. Deny direct access to core WordPress files, themes and plugins\n1. Install WAF for WordPress (this project)\n1. Use [Leanmail](https://github.com/szepeviktor/debian-server-tools/tree/master/security/fail2ban-leanmail)\n   for filtering Fail2Ban notification emails\n\nSee the [Block WordPress attack vectors](https://github.com/szepeviktor/wordpress-website-lifecycle/blob/master/WordPress-security.md)\nnote in my other repository for an overview of the topic.\n\n## Composer installation\n\nTechnically this is not a WordPress plugin nor an MU plugin.\nWAF for WordPress is distributed and autoloaded as a Composer package.\n\n1. Issue `composer require szepeviktor/waf4wordpress` command\n1. Load `vendor/autoload.php` from your `wp-config`\n1. Instantiate `SzepeViktor\\WordPress\\Waf\\HttpAnalyzer` class early in `wp-config`\n    ```php\n    require dirname(__DIR__) . '/vendor/autoload.php';\n    new SzepeViktor\\WordPress\\Waf\\HttpAnalyzer();\n    ```\n1. Create an MU plugin in `wp-content/mu-plugins/waf4wordpress.php`\n    ```php\n    \u003c?php\n    /*\n     * Plugin Name: WAF for WordPress (MU)\n     */\n    if (! function_exists('add_filter')) {\n        exit;\n    }\n    new SzepeViktor\\WordPress\\Waf\\CoreEvents();\n    ```\n\n## Manual installation\n\n:bulb: Please see [Composer-managed WordPress](https://github.com/szepeviktor/composer-managed-wordpress)\nfor managing WordPress with Composer.\n\nTechnically this is not a WordPress plugin nor an MU plugin.\n\n1. First download\n    [WAF for WordPress](https://github.com/szepeviktor/waf4wordpress/archive/refs/heads/master.zip)\n    then extract files to a directory, e.g. `waf/`\n1. Instantiate `SzepeViktor\\WordPress\\Waf\\HttpAnalyzer` class early in `wp-config`\n    ```php\n    require_once __DIR__ . '/waf/src/HttpAnalyzer.php';\n    require_once __DIR__ . '/waf/src/CoreEvents.php';\n    new SzepeViktor\\WordPress\\Waf\\HttpAnalyzer();\n    ```\n1. Create an MU plugin in `wp-content/mu-plugins/waf4wordpress.php`\n    ```php\n    \u003c?php\n    /*\n     * Plugin Name: WAF for WordPress (MU)\n     */\n    if (! function_exists('add_filter')) {\n        exit;\n    }\n    new SzepeViktor\\WordPress\\Waf\\CoreEvents();\n    ```\n\n## Configuration\n\nWAF for WordPress is configured in source code\nbefore class instantiation. in `wp-config`.\n\nCreate custom filters for Fail2Ban catching these PHP messages.\n\n- Likely malicious requests: `Malicious traffic detected:` may be banned after 6 attempts per 10 minutes\n- Surely break-in attempts: `Break-in attempt detected:` may be banned instantly\n\n### How to support PayPal IPN, Braintree and custom entry points in poorly written plugins\n\nCopy this into your in `wp-config.php`.\n\n```php\n// Enable PayPal IPN in WooCommerce\nif ( isset( $_SERVER['REQUEST_URI'] ) ) {\n    if ( '/wc-api/WC_Gateway_Paypal/' === parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ) ) {\n        // PayPal IPN does not send Accept: and User-Agent: headers\n        $_SERVER['HTTP_ACCEPT'] = '*/*';\n        $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 PayPal/IPN';\n    }\n}\n\n// Enable Braintree Webhooks\nnew \\Waf4WordPress\\Braintree_Fix( '/braintree/webhook' );\n\n// Enable email opens in Newsletter plugin\nif ( isset( $_SERVER['REQUEST_URI'] ) ) {\n    $newsletter_path = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );\n    if ( '/wp-content/plugins/newsletter/statistics/open.php' === $newsletter_path\n        || '/wp-content/plugins/newsletter/statistics/link.php' === $newsletter_path\n    ) {\n        // UA hack for old email clients\n        $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 ' . $_SERVER['HTTP_USER_AGENT'];\n    }\n    unset( $newsletter_path );\n}\n\n// Enable email open tracking in ALO EasyMail Newsletter plugin\nif ( isset( $_SERVER['REQUEST_URI'] ) ) {\n    $alo_path = parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH );\n    if ( '/wp-content/plugins/alo-easymail/tr.php' === $alo_path ) {\n        // UA hack for old email clients\n        $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 ' . $_SERVER['HTTP_USER_AGENT'];\n    }\n    unset( $alo_path );\n}\n```\n\n## Bug reports and feature requests\n\n[Open a new issue](https://github.com/szepeviktor/waf4wordpress/issues/new)\n\n## Where script kiddies look for WordPress\n\n- `/backup/`\n- `/blog/`\n- `/cms/`\n- `/demo/`\n- `/dev/`\n- `/home/`\n- `/main/`\n- `/new/`\n- `/old/`\n- `/portal/`\n- `/site/`\n- `/test/`\n- `/tmp/`\n- `/web/`\n- `/wordpress/`\n- `/wp/`\n\nBest not to create these directories to avoid lengthy log excerpts.\n\n[href-composer-file]: https://github.com/szepeviktor/waf4wordpress/blob/master/composer.json\n[href-license-file]: https://github.com/szepeviktor/waf4wordpress/blob/master/LICENSE\n[href-packagist]: https://packagist.org/packages/szepeviktor/waf4wordpress\n[href-packagist-stats]: https://packagist.org/packages/szepeviktor/waf4wordpress/stats\n[href-phpstan-org]: https://phpstan.org/\n[src-latest-version]: https://img.shields.io/packagist/v/szepeviktor/waf4wordpress.svg\n[src-packagist-downloads]: https://img.shields.io/packagist/dt/szepeviktor/waf4wordpress.svg\n[src-packagist-license]: https://img.shields.io/packagist/l/szepeviktor/waf4wordpress\n[src-phpstan-enabled]: https://img.shields.io/badge/PHPStan-enabled-44CC11\n[src-php-version]: https://img.shields.io/packagist/dependency-v/szepeviktor/waf4wordpress/php\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fszepeviktor%2Fwaf4wordpress","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fszepeviktor%2Fwaf4wordpress","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fszepeviktor%2Fwaf4wordpress/lists"}