A web application firewall inspects incoming traffic before it reaches your site and blocks the patterns associated with known attacks — malicious code injection attempts, known exploit signatures, obviously automated scanning — without you having to recognise or respond to each attempt yourself. It’s protection going forward; it doesn’t undo anything that got through before it was in place.
Firewall (WAF) plugin configuration
A web application firewall configured to filter attacks before they reach your site.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Access to the WAF plugin or service you want configured, or a recommendation if you don’t have one yet
- Confirmation of any legitimate traffic patterns that might look unusual (an API integration, a known scraper you actually want)
- Your tolerance for strictness versus the risk of false positives blocking real visitors
This or something else?
| You want a firewall configured to filter malicious traffic before it reaches your site | This fix covers it |
| The firewall is already active but blocking legitimate traffic | Security plugin false positive tuning, a more targeted fix |
| You specifically want Cloudflare’s firewall configured, not a WordPress plugin-based one | Cloudflare WAF rule configuration, the more specific version |
| Your site is already compromised and you need cleanup, not prevention | Outside what this fix does — that’s a different, forensic specialism |
What we do
- Select and configure an appropriate WAF for your hosting and traffic profile
- Enable rule sets covering common attack patterns relevant to WordPress
- Whitelist any confirmed legitimate traffic that might otherwise be flagged
- Test that normal site function and legitimate traffic pass through unaffected
- Monitor initial results for false positives and adjust
- Document the configuration and how to review blocked traffic later
What is included
- A configured, tested web application firewall
- Rule sets appropriate to common WordPress attack patterns
- Whitelisting of confirmed legitimate traffic
- A written note on the configuration and how to review activity
Not included
- Cleaning up an already-compromised site — this protects going forward, not retroactively
- Ongoing rule tuning as new threats emerge
- Cloudflare-specific configuration, a related but distinct fix if that’s your setup
- Guaranteeing zero false positives, which no firewall configuration can promise absolutely
Questions about this fix
Will a firewall remove malware that's already on my site?
No — a firewall filters incoming traffic going forward, it has no ability to detect or remove something already present on the server, which needs a different, forensic approach.
Could this block legitimate visitors or customers by mistake?
It's possible with any firewall, which is why we tune it against your specific known traffic patterns and monitor initial results rather than leaving default settings unchecked.
Do I need this if I already have a security plugin?
Many security plugins include some firewall functionality — we assess what you already have and configure or upgrade it rather than necessarily adding something redundant.
Is a WordPress plugin firewall as good as one at the hosting or CDN level?
They work differently and can complement each other — a CDN-level firewall (like Cloudflare's) filters traffic before it even reaches your server, which is generally a stronger position than a plugin acting after traffic arrives.
How do I know if the firewall is actually working after this?
We provide a way to review blocked traffic and can walk through what a genuine block looks like, so it's not just a setting you have to trust blindly.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.