8G Firewall
After more than a year of beta testing, 8G Firewall is ready for use on production sites. So you can benefit from the powerful protection provided by the latest evolution of the nG Firewall (aka nG Blacklist). The 8G Firewall offers lightweight, server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. 8G is a lightweight (only 17KB) strong firewall that provides site security and peace of mind. Plus, 8G is open source and 100% free for everyone :)
SetEnvIf instead of mod_rewrite. Learn more and download at GitHub.Contents
About 8G Firewall
The 8G Firewall is a carefully crafted set of security rules for Apache and Nginx servers. It can be applied via your site’s public root .htaccess file, or added via server configuration. Once added, 8G provides powerful server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. It’s a lightweight (only 17KB) strong firewall that improves site security and peace of mind.
8G Firewall builds on 7G, optimizing scope with performance while minimizing false positives. Learn more about nG-series firewall, including 8G and all the details:
Reporting Bugs
As of version 1.3, 8G is out of beta and ready for production sites. Any bugs (false positives) may be reported via my contact form. Or if you have any questions or non-bug-related feedback, you are welcome to leave a comment on this post. Thank you :)
Download 8G Firewall
By downloading 8G, you agree to the terms set forth in the License and Disclaimer. You will find copy of the 8G changelog included in the zip download file. Check out the nG homepage for install steps and complete information.
License & Disclaimer
8G Firewall is open source and 100% free for all. The only requirement is that the following credit lines are included when using 8G (or any of its parts).
# 8G FIREWALL
# https://perishablepress.com/8g-firewall/Other than that, it’s all yours!
Disclaimer
The 8G Firewall is provided “as-is”, with the intention of helping people protect their sites against bad requests and other malicious activity. The code is open and free to use and modify as long as the first two credit lines remain intact. By using this code you assume all risk and responsibility for anything that happens. So use wisely, test thoroughly, and enjoy the benefits of my work :)
Show support
I spend countless hours developing the nG Firewall. I share it freely and openly with the hope that it will help make the Web a more secure place for everyone.
If you benefit from my work with nG Firewall and would like to show support, consider buying one of my books, such as .htaccess made easy. You’ll get a complete guide to .htaccess, exclusive forum access, and a ton of awesome techniques for configuring, optimizing, and securing your site.
Of course, tweets, likes, links, and shares are super helpful and very much appreciated. Your generous support allows me to continue developing the nG Firewall and other awesome resources for the community. Thank you kindly :)
8G Notes
Any 8G-related notes will be added/updated below..
- Only use 7G or 8G, not both
- 8G is modular: each section can be removed/added as desired
- There is an addon to block AI bots: Ultimate Block List to Stop AI Bots »
- 8G is designed to work flawlessly on any website, not just WordPress
- 8G adds new “HTTP COOKIE” rules
- Please report any strings or user agents that should not be blocked
- Always test well before going live and report any bugs or issues
- If using the “WebP Express” plugin, remove
envfrom Request URI rules - To enable “phpinfo() WP” plugin, remove
phpinfofrom Query String rules - To enable the “Ahrefs” bot, remove
ahrefsfrom User Agent rules - Also note that 8G blocks the W3 Validator (I am unable to figure out why)
WordPress
If you need exact-match search results (i.e., surrounding search terms with quotation marks) when attaching items from the Media Library to a post, make the following edit. Locate this line:
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%22|%27|%3c|%3e|%00)(.*)...And remove %22|, so the line becomes:
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%27|%3c|%3e|%00)(.*)...Joomla
If you use Joomla plugin JCE Pro, make the following edit. Locate this line:
RewriteCond %{REQUEST_URI} (/)(filemanager|htdocs|httpdocs...And remove filemanager|, so the line becomes:
RewriteCond %{REQUEST_URI} (/)(htdocs|httpdocs...Other 8G-related notes will be added here..
Perishable Press is operated by Jeff Starr, a professional web developer and book author with two decades of experience.
Here you will find posts about web development, WordPress, security, and 
204 responses to “8G Firewall”
Hi Jeff,
I’m still on 6G ☺
WordPress is installed in a subdirectory http://www.mydomain.com/blog
The main domain just redirects to a page in the blog:
http://www.mydomain.com redirects to >>> http://www.mydomain.com/blog/page1234
How should I add the 8G code?!
should the “QUERY STRING” rules still be added to the WordPress subdirectory .htaccess, and everything else to the root .htaccess ?!
Thanks for the great work.
Hi Rafael, it really depends on what all you’ve got going on site. Best advice is to just do some basic testing. First place the Query String rules at the beginning of the file and then test. If it works then great, if not then try at the end of the file, etc. Then do the same thing with the remainder of the nG rules should help get you there.
Hi Jeff,
How is 8G on OpenLiteSpeed?
Thank you.
7G yes, but not yet 8G for OpenLiteSpeed.
phpbb3 v 3.3.11
Apache Version 2.4.59
PHP Version 7.4.33
I comment out this line.
Thanks for your work on this. I’m evaluating it for potential use on a set of smaller Drupal 10 sites.
I’m curious if you have a public git repository for this project so folks can better automate the library into their CI workflows and projects, to get easy version number support at unique URLs for automated download, and to be able to pin version numbers in their build scripts, and to get public diff functionality and issue queues.
No sorry, I don’t use repository for nG Firewall. You are free to set one up though, the code is 100% free and open source.
Thanks. Are previous point-release versions of 7G and 8G available for download from somewhere?
No but I can send a copy of any version. Hit me up via contact form anytime.
Many thanks for the great job.
I added 8G to htaccess and it blocks all unwanted bots beautifully.
However, I am receiving reports from users that they cannot access the forum via Tapatalk. How to unlock it? Which rule is responsible for this?
Just need the URL(s) getting blocked and I would be glad to take a look.
In the logs it looks like this:
I disabled the entire [QUERY STRING] section and Tapatalk became active:
Maybe there is no need to disable the entire section and only a specific rule (set of rules) is enough. ?
Well
Tapatalkis not blocked in 8G Firewall. Butmobiquois blocked in the REQUEST URI rules. To unblock it, locate this string:mobiquo|muiebl; and replace it with justmuieblshould do the trick.Hi Jeff! I’ve been using 7G but I’m now implementing the new 8G 1.3. Recently, my site has been hammered with a rogue bot that’s daily making around 100 or so requests over a half minute interval, all for the same page. The full line in my log file is:
2024-05-01 00:26:39 42.202.17.88 /contact.php Go-http-client/1.1
I’m guessing that the go-http-client is an off the shelf bot used by any number of script kiddies scraping the web. Would I just add Go-http-client to the HTTP_USER_AGENT list?
Thanks for being on our side!
Hi Mark, yes you can add this as the first line in the USER AGENT section:
Then later you can add any other user agents like this:
Multiple user agents are separated by a vertical bar,
|.I had a webp image (shell_energy-png.webp) on my site that refused to load with the 8G firewall. Tracked the problem down to this line:
I know “shell” is a rather common networking term, but it’s worth remembering that it’s also the name of a global mega corp and lots of other businesses :).
Yeah somehow I totally forgot about Shell oil company lol. Feel free to remove any offending pattern(s) as you see fit.
Do I just remove this bit Jeff – “(c99|php|web)?shell|” – or only “shell|”?
Correct, remove
(c99|php|web)?shell|should do it.Admirable idea, effort, and result! I highly recommend this.
this line actually causes Elementor to not save
What is the URL(s) that is getting blocked by that line, so I can take a look and try to resolve asap.
This rule:
..is blocking Amazonbot.
Okay will try again..
What is the specific user agent that is getting blocked by that line, so I can take a look and try to resolve asap.
I just downloaded the 8G firewall zip. When checking the 8G-Firewall.txt, I noticed that the last opening
<IfModule mod_rewrite.c>did not have a closing</IfModule>Is this intentional? If not, “hey, I might have found a bug!” :D
(I’m pretty sure your target audience would already know how to fix it)
There are no issues that I can see. All
<IfModule>tags include corresponding closing</IfModule>tags. Maybe try downloading the 8G code/file again in case something happened and the last line got cut off somehow..? Let me know how I can help, thank you.Hi Jeff, awesome idea – it would be amazing if there was an option to remove the catch-all handling of wordpress, e.g. by default WP handles all incoming requests, which is stupid and abuses all server resources (e.g. when hit by bots scanning 1000s of non-existing urls). Would you know of a way to use 8g perhaps to achieve this? Cheers
Hi Tom,
The server handles all incoming requests. That’s why 8G Firewall is so effective at blocking bad requests and conserving server resources. It denies bad requests at the server level, so expensive things like the database, PHP, images, scripts and other assets don’t have to be loaded. I hope this is clear: WordPress does not “handle all incoming requests”; the server does.