Plugin Sale! Save 15% on pro plugins with discount code: FALL2020
Web Dev + WordPress + Security

7G Firewall

[ 7G Firewall (Beta) ] The 7G Firewall is here! 7G is now out of beta and ready for production sites. So you can benefit from the powerful protection of the latest nG Firewall (aka nG Blacklist).

The 7G Firewall offers lightweight, server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense.

7G is a lightweight (only 12KB) strong firewall that provides site security and peace of mind. Plus, 7G is open source and 100% free for everyone :)

Contents

About 7G

Two unwritten laws of the Web: 1) Nothing is 100% secure, and 2) All websites are under pretty much 24/7 constant attack. Whether it’s just nuisance traffic like spam, or serious in-your-face DDoS attack, now is the time to strengthen site security and lock things down. 7G helps with this by protecting your site against many types of bad requests and attacks. It gives your site a super strong layer of protection at the server level. So bad requests are blocked without having to load up PHP, MySQL, and everything else.

I’ve seen many times sites just getting hammered with bad traffic.. then you add nG Firewall and watch the noise drop to zero. You free up all those server resources for the good traffic.

What’s the downside? Same as with any firewall, potential false positives. Fortunately for us, 7G is the seventh generation of a firewall/blacklist that comprises over a decade of research, testing, and development. 7G integrates the best features of all previous nG Firewalls and builds upon them. So the goal for 7G is zero false positives. Hence the purpose of the “beta” version is to fine-tune the firewall rules based on larger sample size.

Bottom line: 7G is an easy-to-use, cost-effective way to secure your site against malicious HTTP activity. It helps to protect against evil exploits, ill requests, and other nefarious garbage, such as XSS attacks, code injections, cache poisoning, response splitting, dual-header exploits, and more.

How It Works

The 7G Firewall is a powerful, well-optimized set of rewrite rules that checks all URI requests against a set of carefully constructed Apache/.htaccess directives. This happens quietly behind the scenes at the server level, which is optimal for performance because it avoids the need to load up PHP and MySQL just to block a bad request. This is one reason why securing at the server level is better than using a plugin or other PHP script.

7G improves performance by freeing up server resources.

And it’s super-easy to add 7G to your site. Just add the code to your site’s root .htaccess file and then sit back and relax while 7G works its magic. That’s the beauty of it: there is no configuration required. Security via simplicity: add the code and done. For more details, check out the Deployment section below.

Check out a live demo of 7G Firewall »

Once implemented, 7G scans every HTTP request made to your site. It compares key aspects of each request against a carefully formulated set of patterns and regular expressions (regex). So if someone or something triggers a match, they immediately are blocked silently behind the scenes (via 403 Forbidden response). So legitimate visitors can continue to surf your site with total confidence, while the bad guys are getting stomped by 7G.

Features

7G is a strong firewall that is lightweight and super fast. It strives for the optimal balance between security and performance, delivering significantly better protection than previous nG. Each iteration of nG builds upon previous versions, fortifying successful patterns, removing outdated patterns, and of course adding new patterns and rules based on current data. The result is a 7th-generation firewall that is cumulatively developed and extensively tested, based on code with a proven track record.

Here are some top features and goals of the 7G Firewall:

  • Security via simplicity
  • Extensive firewall protection
  • Fine-tuned to minimize false positives
  • Lightweight (only 12KB!), modular, flexible and fast
  • Completely plug-&-play with no configuration required
  • Improves security, reduces server load, and conserves resources
  • Git/SVN friendly (does not block svn/git files et al)
  • Open source, easy to use, and completely free
  • 100% compatible with WordPress
  • Better bad bot detection
  • Built-in logging! :)

7G protects against many types of attacks and threats, including:

  • Directory Traversal
  • HTTP Response Splitting
  • (XSS) Cross-Site Scripting
  • Cache Poisoning
  • Dual-Header Exploits
  • SQL/PHP/Code Injection
  • File Injection/Inclusion
  • Null Byte Injection
  • WordPress exploits such as revslider, timthumb, fckeditor, et al
  • Exploits such as c99shell, phpshell, remoteview, site copier, et al
  • PHP information leakage

Additionally, the 7G Firewall protects against a wide range of malicious requests, bad bots, spam, and other nonsense. Further, 7G uses Apache’s mod_rewrite, so it works on all types of HTTP request methods: GET, POST, PUT, DELETE, and all others. That means robust protection for your website.

Requirements

Here are the only requirements for 7G Firewall:

  • Apache server
  • mod_rewrite enabled
  • Access to .htaccess or config

If you are unsure about either of these requirements, ask your web host. If you are new to Apache and/or .htaccess, and want to learn more about it, I wrote an entire book on using .htaccess to secure and optimize your site. Also, here is a tutorial that explains how to create an .htaccess file on your local machine.

If your site does not meet the requirements, check out my WordPress plugins, BBQ: Block Bad Queries (free) and BBQ Pro (premium version). These plugins are blazing fast and integrate nG technology, providing strong firewall protection for your WordPress-powered site.

Download 7G Firewall

By downloading this file, you agree to the terms set forth in the License and Disclaimer. Also check out the 7G Changelog. To implement 7G, follow the steps in the Deployment section, below.

7G Firewall Version 1.3 (5KB zip)
Note: To retain the Unix LF EOL characters (line breaks) in the 7G text file, it is recommended to use a program that supports them, such as Notepad++ (free for Windows) or TextEdit (free for Mac). The line breaks keep the code structured and readable, instead of a big jumbled mess.

License

As mentioned previously, the 7G Firewall is entirely open source and free for all to use. The only requirement is that the following credit lines are included wherever 7G is used (note that version and date infos will vary):

# 7G FIREWALL
# @ https://perishablepress.com/7g-firewall/

Other than that, it’s all yours!

Disclaimer

The 7G Firewall is provided “as-is”, with the intention of helping people protect their sites against bad requests and other malicious activity. The code is open and free to use and modify as long as the first two credit lines remain intact. By using this code you assume all risk and responsibility for anything that happens, whether good or bad. In short, use wisely, test thoroughly, don’t sue me.

Deployment

Quick summary: add the 7G code to your site’s root .htaccess file (or Apache config file) and test thoroughly. After proper testing, you’re all set: 7G Firewall protects your site silently with minimal footprint. A completely set-it-and-forget-it firewall solution. Here are the steps to add 7G to your site:

  1. Agree to the terms, download, and unzip 7G
  2. Make a backup of your current .htaccess file
  3. Copy all 7G code and add to your root .htaccess
  4. Save changes and upload to your server
  5. Test well (see next section)

Note: for best results, place 7G code before any existing mod_rewrite rules (e.g., WordPress Permalinks).

Testing & Feedback

This version of the nG Firewall is turn-key equipped for logging via PHP. Here is a complete tutorial on how to log blocked requests via PHP. Further troubleshooting tips available on the 6G Firewall homepage.

Also, if you discover any bugs, issues, or errors, report them directly via my contact form. As always, feel free to share feedback and ask any questions in the comment section. Please do not report bugs in the comment area, thanks :)

Notes & Infos

Here are some miscellaneous notes and tips about the 7G Firewall.

  • 7G is modular: each section can be removed/added as desired
  • It is fine to use multiple nG firewalls, but not recommended
  • 7G is designed to work flawlessly with WordPress and any other website
  • Please report any strings or user agents that should not be blocked
  • Always test well before going live and report any bugs or issues
  • Use Contao CMS? Check out the nG Apache Firewall for Contao
  • If using any sort of “thumb” plugin or script, remove the two lines that include (thumbs?(. One line is in User Agents and the other in Request URI.
  • Other notes will be added here..
7G Addon: Want more 7G WAF protection, check out the free 7G Addon.

Learn More..

To learn more about the theory and development of the 7G Firewall, check out my articles on building the 3G, 4G, 5G Blacklist, and related topics. The 6G Firewall homepage also contains lots of useful and relevant information. And if all that’s not enough, you can view all nG-related posts in the nG tag archive.

Show support

I spend countless hours developing the 7G Firewall. I share it freely and openly with the hope that it will help make the Web a safer place for everyone.

If you benefit from my work with 7G and would like to show support, consider buying one of my books, such as .htaccess made easy. You’ll get a complete guide to .htaccess, exclusive forum access, and a ton of awesome techniques for configuring, optimizing, and securing your site.

Of course, tweets, likes, links, and shares are super helpful and very much appreciated. Your generous support allows me to continue developing the 7G Firewall and other awesome resources for the community. Thank you kindly :)

Support 7G Firewall: Donate via PayPal »

Thank You

Thanks to everyone who shares feedback and helps beta test nG. Also thank you to everyone who supports Perishable Press with links and social shares. Additionally, I would like to thank the following sites for providing the free tools used during development. Please visit and bookmark these awesome resources:

Jeff Starr
About the Author
Jeff Starr = Web Developer. Security Specialist. WordPress Buff.
WP Themes In Depth: Build and sell awesome WordPress themes.

54 responses to “7G Firewall”

  1. Hi Jeff.

    7Gfirewall the perfect combination for wordpress site?

    Sucury FREE + BPS FREE+ 7GFirewall can run together? What´s for YOU the best COMPAGNION for 7gifrewall to high security and high speed?
    many thanks,

    • Jeff Starr
      Jeff Starr 2019/03/17 9:51 am

      First keep in mind that 7G is in “beta” mode, for testing and further development, etc. So not sure if it has been tested with other security scripts/plugins. For my own sites, I just use 6G/7G and/or maybe BBQ WP plugin always keeps performance super fast while securing against many threats.

  2. I’m eagerly awaiting it. Thank you very much for your constant work on the firewall.

    Would like to donate something or pay for the firewall. Is that possible? It’s so simple, efficient and constantly improving, I’d like to support that.

    Many greetings from Germany.

  3. One question… Firewall first in the .htaccess or last after all the other server rules? What’s better?

    • Jeff Starr
      Jeff Starr 2019/03/19 6:59 am

      There are no hard and fast rules for this, it really all depends on the other rules contained in the .htaccess file, as well as any other .htaccess files/rules, config rules, environment, and so forth. Check the article for general recommendation on placement, et al.

  4. That rule below doesn’t work on my server. Better said, it ensures that for example the user agents are only locked out on subpages, but not on the start page.

    RewriteRule . - [F,L]

    What helps is the modification with the following rule including syntax. Then the code also works on the start page. Otherwise it only work on subpages.

    RewriteRule ^(.*)$ - [F,L]

    I don’t know exactly why, but I just wanted to let you know.

    • Jeff Starr
      Jeff Starr 2019/03/22 6:26 am

      That is odd, do you know which version of Apache you are using?

      • LiteSpeed but what works under Apache usually works there as well.

        »is an Apache drop-in replacement, meaning it uses the same configuration format as Apache.«

      • Jeff Starr
        Jeff Starr 2019/03/22 6:55 am

        Yeah that would explain it. May want to ask the Litespeed folks about why wildcard (dot) is not recognized properly. Unless there is some other factor at play in this particular case.

      • I don’t know if you ever got any info back on Lightspeed but would you recommend David’s Lightspeed “fix” as an acceptable mod to enable using 7G without regard to a site being on Lightspeed or not?

      • Jeff Starr

        Not familiar, is there a link I can check?

  5. Hi Jeff,

    I have tested 6G and 7G today. In .htaccess, 6G worked fine, but when trying to use it with the Advanced Directives for Apache within a Plesk VHost there was an error that Require All was not allowed here.

    Then I tried 7G in the Advanced Directives for Apache. The error was “only” that Rewrite Base / was not allowed here.

    Do you think this might be a problem?

    I am asking because I am wondering if I could use your firewall rules not only for one Vhost / domain but for several – by applying it on the level of subscriptions or even an entire server for several Vhosts.

    Kind regards,

    Bernhard

    • Jeff Starr
      Jeff Starr 2019/04/08 8:09 am

      It should be fine to remove the RewriteBase directive. Just do a few tests to make sure the rules are recognized, especially the Query String rules. If so, you’re good to go.

  6. Ken Dawes 2019/04/23 9:45 am

    Hi Jeff,
    I recently came across something that said FollowSymLinks has a security issue and that one should use SymLinksIfOwnerMatch instead.

    SymLinksIfOwnerMatch is a new one to me… Do you know if it is truly preferable? Do you know of any downsides?

    Thanks!
    Ken

  7. I need some hel:
    windows 10 is telling me, that there is an error in the zip and thus cannot unzip it.

    Regards bernd.

    • Jeff Starr

      Last week I spent about 7 hours re-compressing all of my site’s downloadable zip files on Windows 10. Then just now I re-tested the newly generated zip file on Windows 10, using Chrome, Firefox, Edge, IE, and Opera, and all of them downloaded just fine.

      So with that in mind, can you let me know which browser you are using, so I can check it out and try to help asap. Thanks.

      • I got it meanwhile. The downlink obviously didn’t work using the firefox downloader. I switched to another browser and succeeded. Meanwhile I installed 7G (refer to my posting a minute ago). Thanks for the wonderful package 7G.

      • Jeff Starr
        Jeff Starr 2020/01/05 3:54 pm

        Glad to hear you got it :) For Firefox on Win10 it should download/open fine using the built-in downloader. If you have any further issues, please let me know.

      • Jeff, I retried the download with Firefox and Chrome.
        Opening the ZIP from Firefox fails, the Chrome succeeds.
        The ZIP Files are of different Size: The ZIP from Firefox is 3,95 KB, but the Chrome downloads 4,53 KB.
        I use Firefox 71.0 (64-Bit)

      • Jeff Starr
        Jeff Starr 2020/01/06 8:53 am

        Alright thanks, I will do some further investigating. And this is for latest Windows 10, correct?

      • Windows 10, Version 1803
        (My Laptop rejects any newer Version, sorry)

      • Jeff Starr

        Alright thanks. I am running Win 10 v1909, but will test it (again) with Firefox 71 64-bit.

  8. Bernd Kö 2020/01/05 1:47 pm

    what a fantastic concept! I implemented the 7G-Firewall yesterday, and I am totally satisfied.

    I have mostly German visitors on my homepage and adapted to filter Useragents and Referrers I see in my server logs accordingly. Additionally I added blacklists to block IP adresses from Asia and Russia incl. East Europe.

    Fantastic too is the logging feature; this allows to observe if the filters are effective, wonderful.

    Best Regards Bernd.

  9. excellent work Jeff

    is there a way to be informed of new versions? is the code on GitHub or other repo?

    thanks !!!

    • Jeff Starr

      Thanks 12b. I’m not using any repo, but the site provides RSS feeds for both posts and comments to help stay current.

  10. Re: WP Directory installs.
    If WordPress is installed in a sub-directory e.g. https://domain/wordpress/ but the site is configured to appear at https://domain.com which parts of the 7G Script should go into which HTACCESS File?

    • Jeff Starr

      Goes in the root .htaccess and done. Unless the query string rules aren’t recognized in that location. Then the query string rules may need to go in the sub-directory .htaccess.

  11. Hi Jeff,
    do you have any idea what is wrong with my configuration, I get this server error many times:

    Request exceeded the limit of 10 internal redirects due to probable configuration error. Use ‘LimitInternalRecursion’ to increase the limit if necessary. Use ‘LogLevel debug’ to get a backtrace.

    Regards Bernd.

    • Jeff Starr

      It sounds like something is misconfigured, misplaced, or maybe conflicting with existing .htaccess rules.. Couldn’t tell you specifically though, you’ll have to do some basic troubleshooting to figure it out.

  12. I was just directed here, this is some great stuff. I am just curious how long you believe the ‘beta’ tag may be applied to this, or when it might be suitable for production sites? We are currently running 6G, but seeing as this is a year old I thought I would ask about the beta tag.

    • Jeff Starr
      Jeff Starr 2020/01/26 1:25 pm

      Yes 7G is ready now for production sites, and already is in use on many live sites. So it’s out of beta, I just need to update the post to make it all official. Will do that soon. Thanks for the feedback, SteveP.

    • Jeff Starr

      Just to follow up, the post is now updated to reflect 7G is now out of beta and ready for production sites. Cheers.

Comments are closed for this post. Something to add? Let me know.
Welcome
Perishable Press is operated by Jeff Starr, a professional web developer and book author with two decades of experience. Here you will find posts about web development, WordPress, security, and more »
WP Themes In Depth: Build and sell awesome WordPress themes.
Thoughts
Part of my success is from being able to look ahead down the road and see things coming before they actually get here.
Spent some time refreshing my business portfolio at MonzillaMedia.com :)
Tried lots of apps for making animated GIFs from screen captures, so far Kap is my favorite. For example the GIF on this post.
Autumn is my favorite time of year.
Stoked! Had a great interview with Eric over at Speckyboy.com :)
Air finally clearing here in WA. Feeling grateful to breathe again. #oxygenmatters
Past week here in WA state has been hellish. So much smoke, like living in a chimney.
Newsletter
Get news, updates, deals & tips via email.
Email kept private. Easy unsubscribe anytime.