Firewall

The firewall inspects every request before WordPress handles it, without contacting any server. It recognizes SQL injection, server file access, remote file inclusion, code execution, script injection, sensitive file probes and attack tools.

Choose the mode

• Off: no request is inspected.
• Observe: attacks are recorded but nothing is blocked. Recommended to start.
• Block: attacks are blocked and recorded.

Stay in Observe for a few days, look at Recent events, then switch to Block. A legitimate request that looks like an attack would be refused.

Also protect PHP files reached directly

By default the firewall loads with WordPress. To also protect PHP files reached directly, add the line shown in the Firewall tab to your PHP configuration, for example in the .user.ini file at the site root:

auto_prepend_file = "/path/to/wp-content/plugins/sentrixwp/waf/loader.php"

Trusted proxies

If your site is behind a proxy or CDN (Cloudflare, Sucuri, a load balancer), list its addresses under Trusted proxies, one per line. Otherwise every request seems to come from the proxy. A wrong value would let visitors fake their address: only add official ranges.

Block an address

Under Blocked addresses, enter an address or range (for example 203.0.113.0/24). The plugin refuses to block your own address.

Automatic bans

An address that reaches the attack threshold within 10 minutes (5 by default, from 3 to 50) is banned from the whole site. A login lock counts double. The ban grows if it happens again: one hour, then one day, then seven days.

• It is computed locally: nothing is sent to the cloud.
• In Observe mode, bans are logged but not enforced.
• Banned addresses are listed in the Firewall tab, with an Unblock button.