8G Firewall
After more than a year of beta testing, 8G Firewall is ready for use on production sites. So you can benefit from the powerful protection provided by the latest evolution of the nG Firewall (aka nG Blacklist). The 8G Firewall offers lightweight, server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. 8G is a lightweight (only 17KB) strong firewall that provides site security and peace of mind. Plus, 8G is open source and 100% free for everyone :)
SetEnvIf instead of mod_rewrite. Learn more and download at GitHub.Contents
About 8G Firewall
The 8G Firewall is a carefully crafted set of security rules for Apache and Nginx servers. It can be applied via your site’s public root .htaccess file, or added via server configuration. Once added, 8G provides powerful server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. It’s a lightweight (only 17KB) strong firewall that improves site security and peace of mind.
8G Firewall builds on 7G, optimizing scope with performance while minimizing false positives. Learn more about nG-series firewall, including 8G and all the details:
Reporting Bugs
As of version 1.3, 8G is out of beta and ready for production sites. Any bugs (false positives) may be reported via my contact form. Or if you have any questions or non-bug-related feedback, you are welcome to leave a comment on this post. Thank you :)
Download 8G Firewall
By downloading 8G, you agree to the terms set forth in the License and Disclaimer. You will find copy of the 8G changelog included in the zip download file. Check out the nG homepage for install steps and complete information.
License & Disclaimer
8G Firewall is open source and 100% free for all. The only requirement is that the following credit lines are included when using 8G (or any of its parts).
# 8G FIREWALL
# https://perishablepress.com/8g-firewall/Other than that, it’s all yours!
Disclaimer
The 8G Firewall is provided “as-is”, with the intention of helping people protect their sites against bad requests and other malicious activity. The code is open and free to use and modify as long as the first two credit lines remain intact. By using this code you assume all risk and responsibility for anything that happens. So use wisely, test thoroughly, and enjoy the benefits of my work :)
Show support
I spend countless hours developing the nG Firewall. I share it freely and openly with the hope that it will help make the Web a more secure place for everyone.
If you benefit from my work with nG Firewall and would like to show support, consider buying one of my books, such as .htaccess made easy. You’ll get a complete guide to .htaccess, exclusive forum access, and a ton of awesome techniques for configuring, optimizing, and securing your site.
Of course, tweets, likes, links, and shares are super helpful and very much appreciated. Your generous support allows me to continue developing the nG Firewall and other awesome resources for the community. Thank you kindly :)
8G Notes
Any 8G-related notes will be added/updated below..
- Only use 7G or 8G, not both
- 8G is modular: each section can be removed/added as desired
- There is an addon to block AI bots: Ultimate Block List to Stop AI Bots »
- 8G is designed to work flawlessly on any website, not just WordPress
- 8G adds new “HTTP COOKIE” rules
- Please report any strings or user agents that should not be blocked
- Always test well before going live and report any bugs or issues
- If using the “WebP Express” plugin, remove
envfrom Request URI rules - To enable “phpinfo() WP” plugin, remove
phpinfofrom Query String rules - To enable the “Ahrefs” bot, remove
ahrefsfrom User Agent rules - Also note that 8G blocks the W3 Validator (I am unable to figure out why)
WordPress
If you need exact-match search results (i.e., surrounding search terms with quotation marks) when attaching items from the Media Library to a post, make the following edit. Locate this line:
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%22|%27|%3c|%3e|%00)(.*)...And remove %22|, so the line becomes:
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%27|%3c|%3e|%00)(.*)...Joomla
If you use Joomla plugin JCE Pro, make the following edit. Locate this line:
RewriteCond %{REQUEST_URI} (/)(filemanager|htdocs|httpdocs...And remove filemanager|, so the line becomes:
RewriteCond %{REQUEST_URI} (/)(htdocs|httpdocs...Other 8G-related notes will be added here..
Perishable Press is operated by Jeff Starr, a professional web developer and book author with two decades of experience.
Here you will find posts about web development, WordPress, security, and 
204 responses to “8G Firewall”
Thanks for the new Firewall Jeff!
Is it possible to copy the txt.file to my .htaccess when using Nginx? Just like I would using Apache?
No because Nginx doesn’t support Apache/.htaccess.
Of course ;-) So sorry for the confusion. I ment to ask for Litespeed servers NOT Nginx.
Then yes, if it supports Apache/.htaccess then it should work fine. Of course always test well before going live.
Great, thx!
Hi Jeff! I was hoping that you could help me out. I just added Solid Security AND your 8G code to my website. Solid Security does a scan twice a day and I believe the bot is being blocked. I am getting an email saying “site_verification_failed.connection_error”.
Is there a way to whitelist an IP, or do you think it is something else?
If I read it correctly, robots.txt is on the blocking URI pattern? Why?
That is incorrect,
/robots.txtis never blocked by any of my firewalls.Hi Jeff!
Just checked out the v1.4 8g FW. Works like a charm. I was also one of the few who had trouble bringing ckeditor to run. Took me a while to figure out that it was the 8g Firewall. But everything works smoothly now! Thanks a lot for your hard work and effort, so that we may have an easier life maintaining our servers. Most appreciated!
chris
Hey Chris,
Thanks for reporting, glad to hear the new 1.4 version is working well for you. As you’ve seen 1.4 includes a fix for
ckeditorso as to avoid any further false positives. So cheers and thanks for using 8G Firewall! :)Jeff,
I’ve just discovered your “technology” trough a link from Siteground.
Now I’ve installed your BBQ (removed another plugin) and added 8g code to .htaccess before all lines, along with Siteground security plugin already installed before.
Hope this configuration will be enough for avoiding bad links creation in posts.
Thanks
Hi Angelo, both BBQ and 8G provide general firewall protection. Whether or not they protect against any specific attacks depends on the requests being made. If you would like to share some of the problematic URLs/requests, I would be happy to let you know either way. If you don’t want to share publicly you always can reach me via my contact form. Cheers.
Amazing firewall, does it block files info.php, readme.txt and license.txt, Or please advice, what should i do?
It blocks info.php but not license.txt or readme.txt. To check any files/requests visit the 8G test page.
Hi Jeff, how are you?
I wanted to tell you something very important to me. What happens if you implement 8G in an online store? I mean, can it create problems with payment gateways? For example, gateways that depend on connection by redirection? I have my ecommerce set up with WooCommerce and I receive many attacks and, although I have several security measures already applied, I would very much like to include 8G, but I fear that problems may arise at checkout.
I congratulate you for your great work.
All the best!
Hi Tomás, glad to help. Yes people use 8G on all sorts of websites, including online stores. Just make sure to test well before going live, keep an eye on your site’s error log, and report any false positives should they arise. To help keep an eye on things, you can set up error logging, as explained in the article. I hope this helps, cheers!
This seems mostly geared for WordPress usage. Is there anything in particular we need to know and do to use it with phpBB?
Should be fine, nG Firewall is deployed on all sorts of sites across a variety of servers and web hosts. Good idea to check the Notes for any exceptions and such.
already did as you suggested, and I have downloaded 8g firewall size 7.35 KB ZIP, but there is no data when I open it, 0 KB ZIP
Thanks for your patience, I think I resolved the issue. Please try again with clear browser and let me know how it goes.
it worked
Great thanks for confirming. Now I need to apply the fix to other downloads as well (like 7G). Please be patient while I get this sorted, thank you.
Thank you for 8G 1.4. I have been using and testing since 7G. Great piece of work. Thanks for the book htaccess made easy. I could tune some redirections of my htaccess as desired.
Hey everyone,
I’m setting up the 8G Firewall on my CentOS VPS and want to apply it globally across all sites, so I don’t have to maintain it separately for each one.
Right now, I’ve stored my rules in a custom configuration file and included it in the main server httpd configuration. I also made sure that overrides are allowed for the web directory.
Even after restarting Apache, the firewall rules don’t seem to be taking effect. Am I missing something? Or is there a better way to enforce this setup for all sites at once?
Appreciate any help! And thanks, Jeff—this is an awesome project.
Not sure but it sounds like something to ask your web host about.. they will be in a better position to help test and troubleshoot, hopefully get things resolved for you.
Hi Jeff,
I greatly appreciate all your work on the firewall rules. It’s a critical line in our defense.
A few of our sites generate random token strings for use when activating applications. The string is alpha-numeric and is delivered via a link in an email to a user. For example, “site.com/app/activate/XpRSe3xpCYJaA5eBY0HU”
The challenge is that every so often, a firewall rule will match our token, such as “3xp” in the request_uri.
Do you have any recommendations how we could generate tokens that won’t get blocked? Obviously, you added the regex for a reason and I don’t want to remove them arbitrarily to fix .01% false-positives.
Thanks again!
Hi Phil, do you happen to know which rule is blocking?
In this case, this is the specific 3xp rule:
RewriteCond %{REQUEST_URI} (@md5|00.temp00|0byte|0d4y|0day|0xor|wso1337|1h6j5|3xp|40dd1d|4price|70bex?|a57bze893|abbrevsprl|abruzi|adminer|aqbmkwwx|archivarix|backdoor|beez5|bgvzc29) [NC,OR]However, I want to reiterate that this is not the only false positive. For example, “xxx” has also matched (e.g. /app/activate/0vz33SgFzeZfXxxinAk)
I would just comment out the lines that cause the false positive blocking. Or if you want to get surgical you could remove just the specific patterns. Or if you are familiar with regex you could add a negative lookbehind that checks for the presence of
/app/and/or/activate/, so that any matched patterns in the random string will be ignored.