Firewall & Patterns

Overview

The ArmorPro firewall is a request-level filter that inspects every incoming HTTP request and blocks those that match known malicious patterns. It runs inside WordPress on every page load, checking the request URI, query string, user agent, referrer, and IP address against its pattern database.

Unlike regex-based firewalls, ArmorPro uses stripos string matching for pattern detection. This approach is significantly faster and eliminates the risk of ReDoS (Regular Expression Denial of Service) attacks that can be used against regex-based firewalls.

Master toggle

The firewall is controlled by a master toggle at the top of the Firewall tab. When disabled, no requests are inspected or blocked. All firewall settings and the pattern manager are hidden until the toggle is enabled.

How it works

On every request, the firewall checks the following components against all enabled patterns:

1. The request URI is checked against Request URI and IP Address patterns
2. The query string is checked against Query String patterns
3. The user agent header is checked against User Agent patterns
4. The referrer header is checked against Referrer patterns

If any pattern matches, the request is immediately blocked with the configured response code. The block is logged in the firewall log with the matched pattern and request details.

Input normalization

Before pattern matching, ArmorPro normalizes every request field through a multi-step pipeline. This prevents attackers from bypassing patterns by encoding their payloads in different ways. The normalization runs automatically on every request with zero configuration.

All normalization steps run in sequence, so combined evasion techniques (for example, HTML-encoding a hex escape) are also caught. The normalized value is only used for pattern matching; the original request is preserved for logging.

Built-in patterns

ArmorPro ships with over 600 built-in patterns across five categories:

Pattern matching modes

Each pattern uses one of three matching modes:

• contains — Matches if the pattern string appears anywhere in the checked value (substring match)
• endswith — Matches if the checked value ends with the pattern string (suffix match)
• contains_path — Matches against the URI path component only, ignoring query strings

Pattern manager

The pattern manager is the main interface for viewing and controlling firewall patterns. It is located in the Firewall tab below the master toggle.

Pattern table

Each pattern is displayed in a table row with the following columns:

• Enabled — Toggle switch to enable or disable the individual pattern
• Category — Which request component the pattern checks (Request URI, Query String, User Agent, Referrer, IP Address)
• Pattern — The actual string being matched against
• Description — A brief explanation of what the pattern blocks
• Hits — The number of times this pattern has matched and blocked a request

Filtering and management

Use the category filter dropdown to view patterns from a specific category. You can enable or disable individual patterns without affecting others. The Reset Hit Counters button clears all hit counts back to zero.

Custom patterns

You can add your own patterns to extend the firewall beyond the built-in set. Custom patterns use the same string matching engine as built-in patterns.

To add a custom pattern:

1. Find the Add Custom Pattern form in the Firewall tab
2. Select a Category (Request URI, Query String, User Agent, Referrer, or IP Address)
3. Enter the Pattern string to match
4. Add a Description explaining what it blocks
5. Click Add Pattern

Custom patterns can be toggled on and off or deleted entirely. Built-in patterns can be toggled but not deleted.

Firewall settings

Request length limit

Block requests with an unusually large URI or query string. This can prevent certain buffer overflow and injection attacks that rely on oversized payloads. Disabled by default.

Skip logged-in users

When enabled, authenticated WordPress users bypass the firewall entirely. This is off by default. Enable it if the firewall is causing false positives for your logged-in administrators or editors.

Auto-blacklist threshold

IPs that trigger the firewall repeatedly can be automatically added to the permanent blacklist. Options: disabled (default), 3, 5, 10, 15, or 20 firewall hits. When triggered, the IP is added to the Access Control blacklist.

Response code

Choose which HTTP response code is returned to blocked requests:

• 403 Forbidden — Standard denial response. The visitor sees an error page.
• 410 Gone — Tells the requester the resource is permanently gone. Can discourage further scanning.
• 444 Connection Closed — Drops the connection without sending any response body. The most aggressive option, giving attackers no information at all.

Firewall log

Every blocked request is recorded in the firewall log, accessible from the Firewall tab. The log shows:

The log can be exported as a CSV file. Log retention is 7 days on the free tier and 90 days on Pro.

Custom block page

When a request is blocked by the firewall (using 403 or 410 response codes), ArmorPro renders a custom block page informing the visitor that their request was denied. The page is clean, branded, and does not reveal which specific pattern was matched.

Enhanced firewall

The standard firewall runs inside WordPress after PHP and WordPress have fully loaded. For maximum protection, ArmorPro also offers an Enhanced Firewall (WAF) that runs at the PHP engine level before WordPress loads, blocking malicious requests even earlier in the request lifecycle.