Firewall
Block malicious traffic before it reaches WordPress. Covers IP Detection, bot filtering, AI crawler control, country rules, Cloudflare Sync, Traffic Log, and advanced firewall controls.
Firewall
The SiteFort Firewall filters abusive requests, scanner traffic, suspicious bots, blocked IPs, country policies, rate-limit violations, and selected user-agent rules. It also integrates with Cloudflare to push supported rules to the edge before requests reach WordPress.
The Firewall header shows detected IP context, Server-Level WAF status, Cloudflare status, and the master firewall toggle. Firewall states include Updating firewall..., Firewall is ON, Firewall is validating, Firewall is paused, and Firewall is OFF.
Activation
The Activation tab appears in the setup flow and includes Activate SiteFort Firewall, IP Detection, Server-Level WAF, Trusted IPs & Defaults, Cloudflare summary, and Save Activation Settings.
Verify IP Detection First
IP Detection tells SiteFort which request header contains the real visitor IP. This matters for every firewall decision, including bans, allowlists, country rules, rate limits, and lockout actions.
- Open Firewall > Advanced > IP Detection.
- Compare the detected IP with your current public IP or administrator network.
- If the site is behind Cloudflare, use the Cloudflare preset when prompted.
- If your host uses another proxy, choose the correct manual header and configure Trusted Proxy IPs/CIDRs.
- Click Verify again. Enable enforcement only after the warning state clears.
| Detection mode | Use when |
|---|---|
| Automatic (Recommended) | Most sites, including common CDN and hosting proxy setups, when SiteFort can detect the best source. |
| Manual (specify header) | Automatic gives the wrong result and you know the header your proxy or CDN sends. |
| Disabled (direct connection only) | The site receives traffic directly and no proxy or CDN sits in front of WordPress. |
Manual header options include CF-Connecting-IP, X-Forwarded-For, Forwarded, X-Real-IP, X-Client-IP, Client-IP, and X-Cluster-Client-IP. Status panels can report missing headers, wrong manual headers, Cloudflare detection, or setup checks. Actions include Auto-Configure, Verify again, Show diagnostic details, Apply Cloudflare preset, Switch to Automatic, and switching to a recommended header.
Protection
The Protection tab controls bot filtering, scanner detection, community threat feed, and rate limiting. Start with conservative settings, review logs, then tighten as needed.
| Protection | What it does | Recommended use |
|---|---|---|
| Bot & Crawler Policy | Filters bot traffic by profile, with its own on/off toggle independent of the Basic, Balanced, and Maximum profile selection below it. Google, Bing, social previews, and major AI assistants remain allowed at every level. | Keep the toggle on and use Balanced for most sites. Use Maximum only after reviewing business needs for unknown crawlers. |
| Basic profile | Blocks known hacking and vulnerability scanning tools. | Good starting point for cautious production rollouts. |
| Balanced profile | Blocks hacking tools, data scraping bots, and automated scripts. Marked recommended in the UI. | Recommended default for public production sites. |
| Maximum profile | Blocks hacking tools, scraping bots, automated scripts, and unrecognized bot traffic. | Use for high-risk sites that do not rely on niche crawlers, SEO tools, or third-party monitoring bots. |
| Block AI Training Crawlers | Optional toggle below the protection level, off by default. When on, blocks AI crawlers that collect content for model training, such as GPTBot, ClaudeBot, CCBot, and Bytespider, on top of the active profile. | Enable when you do not want your content used for AI model training. AI assistants acting on a visitor request and AI search crawlers stay allowed. |
| Detect & Block Scanners | Detects probes targeting config files, backups, version metadata, and sensitive paths. IPs over threshold are automatically banned. Default threshold is 3 failed attempts within a 10 minute window. | Enable on production sites. Tune failed attempts and observation window if legitimate monitoring triggers it. |
| Community IP Blocklist | Blocks malicious IPs detected across the SiteFort network and refreshes every 6 hours. | Enable unless your environment requires every third-party threat source to be reviewed before enforcement. |
| Rate Limiting | Reduces abusive request spikes and repeated 404 probes without interrupting trusted search crawlers. | Enable for login-heavy, ecommerce, and public content sites. Review Traffic Log during the first week. |
Scanner detection settings include failed attempts per IP from 1 to 20 and an observation window from 1 to 60 minutes, with a default of 3 failed attempts within 10 minutes. Rate limiting settings include Site Requests from 10 to 300 and 404 Not Found Errors from 0 to 100.
AI Crawler Control
The Bot & Crawler Policy treats AI bots by their job rather than as a single group. A separate Block AI training crawlers toggle sits below the protection level and is off by default. It applies on top of the selected profile and does not affect how Google or Bing rank the site.
| Crawler type | Examples | Effect when the toggle is on |
|---|---|---|
| AI training crawlers | GPTBot, ClaudeBot, CCBot, Bytespider, meta-externalagent, Amazonbot | Blocked on every profile, including Basic |
| AI assistants acting on a visitor request | ChatGPT-User, Claude-User, Perplexity-User | Allowed |
| AI search crawlers | OAI-SearchBot, Claude-SearchBot, PerplexityBot | Allowed |
When the toggle is off, AI training crawlers follow the active profile: GPTBot and ClaudeBot are allowed on every level, while data-scraping AI bots such as CCBot and Bytespider are already blocked on Balanced and Maximum as part of the scraping-bot category. AI training crawler blocks appear in the Firewall Traffic Log under the Bot Ban type.
Verified search crawlers
On the Balanced and Maximum profiles, SiteFort confirms requests that claim to be Googlebot or Bingbot using reverse DNS with forward confirmation. Genuine Google and Bing crawlers are always allowed. A request that fakes a Googlebot or Bingbot user agent and fails verification is blocked, while a transient DNS failure is treated as unverified and allowed through, so real crawlers are never blocked during a temporary outage. This runs automatically and requires no configuration.
Probe and Scanner Detection
Detect & Block Scanners catches reconnaissance before it becomes an exploit attempt. SiteFort blocks each matching sensitive-path request and escalates the source IP into the ban list after the configured threshold is reached inside the observation window.
| Detection area | Examples and operational meaning |
|---|---|
| Configuration probes | Requests for .env, .git, .htaccess, .user.ini, and similar paths indicate an automated scanner looking for exposed secrets or server files. |
| WordPress config backups | Requests for backup variants of wp-config.php are high-risk because they often expose database credentials. |
| Backup and dump discovery | Requests for SQL dumps, compressed archives, ZIP files, or tar archives suggest an attacker is searching for downloadable site backups. |
| Version and install metadata | Requests for readme.html, plugin and theme readme.txt, debug logs, error logs, phpinfo.php, and installer paths help attackers fingerprint the stack. |
| Threshold behavior | Each matching request is blocked. The IP is banned only after the failed-attempt count is reached within the observation window. |
| Evidence | Escalated events appear in Firewall Traffic Log as Sensitive Path activity, and the resulting IP block appears in Active Rules. |
Community Threat Feeds
Community IP Blocklist blocks traffic from malicious IPs detected across the SiteFort network and external threat intelligence sources. The UI shows blocked IP count, last synced timestamp, and Fetch Latest Threats.
- The list refreshes every 6 hours when enabled.
- Manual refresh is available from Fetch Latest Threats.
- If a refresh fails or returns no valid entries, SiteFort keeps the last known blocklist instead of silently removing protection.
- Blocks from this feature appear under the Community Blocklist filter in Traffic Log.
Traffic Rules
Traffic Rules lets you block or allow traffic by IP address, country, or crawler name. If Cloudflare Sync is enabled, the Rules screen can show a Synced to Cloudflare badge.
| Rule type | How to configure | Be careful with |
|---|---|---|
| IP Address | Enter an IP, CIDR, or wildcard. Choose Block or Allow, set duration, add a reason, then click Add Rule. Use Allow my current IP when securing your own access. | Allowed IPs bypass all firewall rules. Only allow trusted administrators, monitoring services, office or VPN ranges, or partners. |
| Country | Enable country blocking, choose Block selected countries or Allow only selected countries, select countries, and add them to the policy. | Allow-only mode blocks unknown countries and any country not selected. Use it only when the legitimate visitor countries are known and limited. |
| Bot / Crawler | Enter a User-Agent pattern. Choose Block for unwanted crawlers or Trust for crawlers that should bypass checks. | Trusted patterns bypass all firewall checks, including IP blocks, country rules, threat feeds, scanner detection, and rate limiting. |
Valid IP rules can use IPv4, IPv6, CIDR such as 10.0.0.0/24, or wildcard such as 192.168.1.*. Durations include Permanent, 1 day, 7 days, 30 days, and 90 days. Active Rules show metrics for Blocked IPs, Allowed IPs, Countries, and Bot Rules, plus filters for All, IPs, Countries, Bots, and Allowed.
Country Blocking and GeoIP
Country Blocking enforces geographic policy from the Firewall Rules screen. It supports two modes:
- Block selected countries: only the selected countries are blocked. Unknown countries are allowed because they are not proven to be in the blocked list.
- Allow only selected countries: only selected countries are allowed. Unknown countries are blocked.
| GeoIP source | How SiteFort uses it |
|---|---|
| Cloudflare country headers | When Cloudflare is connected and traffic arrives from a verified Cloudflare edge IP, SiteFort can use the trusted CF-IPCountry header. |
| Cloudflare edge rules | When Cloudflare Sync is enabled, supported country rules can be pushed to Cloudflare so blocked traffic is stopped before WordPress loads. |
| MaxMind GeoIP fallback | MaxMind GeoLite2-Country provides local origin-level lookups without runtime API calls. See MaxMind GeoIP under Settings > Integrations to connect it. |
| No GeoIP source | Country blocking cannot be enabled until Cloudflare edge enforcement or a downloaded MaxMind country database is available. |
| Administrator access | Logged-in administrators are exempt from origin-level country checks. Cloudflare edge rules still apply before WordPress loads. |
Cloudflare Sync
Cloudflare Sync pushes supported SiteFort firewall rules to Cloudflare before requests reach your server. Use it when the domain is routed through Cloudflare and you want edge-level enforcement for high-volume blocking.
| Cloudflare status or feature | Meaning |
|---|---|
| Connect Cloudflare | Cloudflare credentials are not configured. Open Settings > Integrations and add a Cloudflare API Token. |
| Cloudflare Connected | SiteFort verified the zone and required permissions. |
| Cloudflare Connection Issue | Credentials are saved, but SiteFort could not verify a working connection for this website. |
| Block at the edge | Blocked IPs and countries are stopped at Cloudflare's global network before reaching your server. |
| 300+ global locations | Cloudflare enforces rules from the nearest data center to the attacker, reducing origin load. |
| Live attack escalation | IPs that repeatedly trigger firewall blocks are temporarily escalated to Cloudflare edge blocks. |
When sync is enabled, rule changes push automatically and Push now forces an immediate sync. Status can show plan badge, processing state, Cloudflare limits, last push time, completed-with-warning messages, conflicting targets, and plan limit warnings.
Automatic Edge Blocks for Active Attacks uses four fields: Block Threshold from 2 to 50, Observation Window from 1 to 1440 minutes, Edge Block Duration from 5 to 10080 minutes, and Max Edge Blocks capped by the detected Cloudflare plan. These temporary blocks are managed separately from the manual block list.
Advanced Firewall Settings
Trusted Proxy Configuration
Trusted Proxy Configuration ensures proxy headers are trusted only when the direct connection comes from a known proxy server. This prevents attackers from spoofing headers such as X-Forwarded-For. Provider options are None, Cloudflare with auto-updated ranges, and Custom IPs/CIDRs.
Server-Level WAF
Server-Level WAF intercepts malicious requests at the server level before WordPress loads, so blocks and rate limits take effect earlier in the request lifecycle. States can include checking availability, not installed, active at the web server layer, installed while runtime activation is being verified, pending activation, another server-level firewall conflict, stale runtime state, and current startup file.
If automatic file writing is disabled or server configuration is managed by your host, use generated manual rules or involve hosting support. Then click Check again.
Trusted IPs & Defaults
- Trusted IPs: one IP address, CIDR range, or wildcard per line. Trusted entries bypass all firewall rules.
- Block Page Message: message shown to visitors whose requests are blocked by the firewall.
- Default Block Duration: used for manually added IP blocks unless a rule overrides it.
- Add my current IP: useful before enabling strict controls from a new network.
Firewall Traffic Log
Firewall Traffic Log is the first place to look when a visitor reports a block or when traffic suddenly spikes. Filter by attack type, search by IP, select a time range, export CSV, refresh, and page through results.
Available type filters are All Types, IP Ban, Rate Limit, 404 Flood, XML-RPC, Sensitive Path, Community Blocklist, Country Block, UA Ban, Bot Ban, Login Lockout, and REST API Block. Time ranges include 24h, 7d, 30d, and All.