Super Plugin Sale! Your Choice: BOGO or 30% Off »
Web Dev + WordPress + Security

8G Firewall

After more than a year of beta testing, 8G Firewall is ready for use on production sites. So you can benefit from the powerful protection provided by the latest evolution of the nG Firewall (aka nG Blacklist). The 8G Firewall offers lightweight, server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. 8G is a lightweight (only 17KB) strong firewall that provides site security and peace of mind. Plus, 8G is open source and 100% free for everyone :)

Update: 8G Firewall is out of beta as of version 1.3, now available for download. A huge thank you to all beta testers :)
Update: 8G has been forked by Tonk√ľnstler-on-the-Bund to use SetEnvIf instead of mod_rewrite. Learn more and download at GitHub.


About 8G Firewall

The 8G Firewall is a carefully crafted set of security rules for Apache and Nginx servers. It can be applied via your site’s public root .htaccess file, or added via server configuration. Once added, 8G provides powerful server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. It’s a lightweight (only 17KB) strong firewall that improves site security and peace of mind.

8G Firewall builds on 7G, optimizing scope with performance while minimizing false positives. Learn more about nG-series firewall, including 8G and all the details:

Support 8G Firewall: Donate via PayPal or your favorite digital coin »

Reporting Bugs

As of version 1.3, 8G is out of beta and ready for production sites. Any bugs (false positives) may be reported via my contact form. Or if you have any questions or non-bug-related feedback, you are welcome to leave a comment on this post. Thank you :)

nG Logging: Just FYI, 7G and 8G Firewall support logging of each request, matching patterns, and more. Learn how to enable logging with nG Firewall.

Download 8G Firewall

By downloading 8G, you agree to the terms set forth in the License and Disclaimer. You will find copy of the 8G changelog included in the zip download file. Check out the nG homepage for install steps and complete information.

Download 8G FirewallVersion 1.3 ( 7.13 KB ZIP )
Note: To retain the Unix LF EOL characters (line breaks) in the 8G text file, it is recommended to use a program that supports them, such as Notepad++ (free for Windows) or TextEdit or BBEdit (free for Mac). The line breaks keep the code structured and readable, instead of a big jumbled mess.

License & Disclaimer

8G Firewall is open source and 100% free for all. The only requirement is that the following credit lines are included when using 8G (or any of its parts).


Other than that, it’s all yours!


The 8G Firewall is provided “as-is”, with the intention of helping people protect their sites against bad requests and other malicious activity. The code is open and free to use and modify as long as the first two credit lines remain intact. By using this code you assume all risk and responsibility for anything that happens. So use wisely, test thoroughly, and enjoy the benefits of my work :)

Show support

I spend countless hours developing the nG Firewall. I share it freely and openly with the hope that it will help make the Web a more secure place for everyone.

If you benefit from my work with nG Firewall and would like to show support, consider buying one of my books, such as .htaccess made easy. You’ll get a complete guide to .htaccess, exclusive forum access, and a ton of awesome techniques for configuring, optimizing, and securing your site.

Of course, tweets, likes, links, and shares are super helpful and very much appreciated. Your generous support allows me to continue developing the nG Firewall and other awesome resources for the community. Thank you kindly :)

Support 8G Firewall: Donate via PayPal, Stripe, or your favorite digital coin »

8G Notes

Any 8G-related notes will be added/updated here..

  • Only use 7G or 8G, not both
  • 8G is modular: each section can be removed/added as desired
  • 8G is designed to work flawlessly with WordPress or any other non-WP site
  • 8G adds new “HTTP COOKIE” rules
  • Please report any strings or user agents that should not be blocked
  • Always test well before going live and report any bugs or issues
  • Joomla sites: remove “administrator” from Request URI rules
  • Other 8G-related notes will be added here..

About the Author
Jeff Starr = Creative thinker. Passionate about free and open Web.
USP Pro: Unlimited front-end forms for user-submitted posts and more.

94 responses to “8G Firewall”

  1. Hi Jeff!

    Thanks for your hard work! I use the firewall in my home-built CMS. Works like a charm.
    Only thing: I had to remove home from the list. It would make my navigation run into “403 forbidden” when going to the home page!

    Thanks and best regards!

    • Jeff Starr 2024/06/15 5:44 pm Reply

      Thanks for reporting, Chris. I will look at removing or modifying the “home” pattern in the next update. Cheers!

  2. I am seeing a lot of spam from bot called “nbot” and doesn’t seem to be covered in 7G. Does 8G block it?

  3. Jeff when do you think a update will be released? Love the 8G it seems to be working flawlessly and it speeds up the site as well. also improved GTMetrix

    • Jeff Starr 2024/07/05 12:17 pm Reply

      There are some pending changes but nothing super critical. Is there something specific you need help with, or needs updated?

  4. Following part needs to be removed to prevent breaking design of the vBulletin 4 forum:


    I am unsure why it is there, what is wrong with it in order to be added. Can you remove it?

    • Jeff Starr 2024/07/17 12:02 pm Reply

      It is “there” because it is a highly targeted pattern/string in malicious URI requests. You can remove it (or any string) as needed, the firewall is meant to be customized.

  5. Hello, I have submitted a contact form around 2-3 times (last time it was ~yesterday) in the past regarding non working 7G and 8G logging and never received a reply. If you have not received it, can you please link to your email or other contact?

  6. I wanted to note that the rule:

    RewriteCond %{REQUEST_URI} (/)((force-)?download|framework/main)(\.php) [NC,OR]

    blocks a needed file download at:

    so i have tweaked that rule. Btw. thank you for this nice firewall.

  7. Its working very well, I dont see any error. Good job Jeff Starr.

  8. Hello, i want to know how to install it on nginx server thanks. Appreciate your hard work !

  9. Just a small FYI. I found that this line was breaking the local insertion of some javascript in one of the CMS’ we use.

    RewriteCond %{REQUEST_URI} (/)((.*)crlf-?injection|(.*)xss-?protection|__(inc|jsc)|administrator|author-panel|cgi-bin|database|downloader|(db|mysql)-?admin)(/) [NC,OR]

    Figured out it was the “database” entry because the CMS had a sub-dir with the same name that held a bunch of related javascript files for the menu system.

  10. Hey Jeff, thanks a ton for your work on the nG firewalls, they have been total life savers as it helps me sleep a little better at night!

    I ran into an issue when using quotes on a search page, e.g.:


    Removing |%22 from the line %0a|%0d|%22|%27|%3c|%3e|%00 fixed it for me, figured I’d mention this use case.

Leave a reply

Name and email required. Email kept private. Basic markup allowed. Please wrap any small/single-line code snippets with <code> tags. Wrap any long/multi-line snippets with <pre><code> tags. For more info, check out the Comment Policy and Privacy Policy.

Subscribe to comments on this post

Perishable Press is operated by Jeff Starr, a professional web developer and book author with two decades of experience. Here you will find posts about web development, WordPress, security, and more »
USP Pro: Unlimited front-end forms for user-submitted posts and more.
All free plugins updated and ready for WP 6.6 dropping next week. Pro plugin updates in the works also complete :)
99% of video thumbnail/previews are pure cringe. Goofy faces = Clickbait.
Crazy that we’re almost halfway thru 2024.
I live right next door to the absolute loudest car in town. And the owner loves to drive it.
8G Firewall now out of beta testing, ready for use on production sites.
It's all about that ad revenue baby.
Get news, updates, deals & tips via email.
Email kept private. Easy unsubscribe anytime.