8G Firewall
After more than a year of beta testing, 8G Firewall is ready for use on production sites. So you can benefit from the powerful protection provided by the latest evolution of the nG Firewall (aka nG Blacklist). The 8G Firewall offers lightweight, server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. 8G is a lightweight (only 17KB) strong firewall that provides site security and peace of mind. Plus, 8G is open source and 100% free for everyone :)
SetEnvIf instead of mod_rewrite. Learn more and download at GitHub.Contents
About 8G Firewall
The 8G Firewall is a carefully crafted set of security rules for Apache and Nginx servers. It can be applied via your site’s public root .htaccess file, or added via server configuration. Once added, 8G provides powerful server-level protection against a wide range of malicious requests, bad bots, automated attacks, spam, and many other types of threats and nonsense. It’s a lightweight (only 17KB) strong firewall that improves site security and peace of mind.
8G Firewall builds on 7G, optimizing scope with performance while minimizing false positives. Learn more about nG-series firewall, including 8G and all the details:
Reporting Bugs
As of version 1.3, 8G is out of beta and ready for production sites. Any bugs (false positives) may be reported via my contact form. Or if you have any questions or non-bug-related feedback, you are welcome to leave a comment on this post. Thank you :)
Download 8G Firewall
By downloading 8G, you agree to the terms set forth in the License and Disclaimer. You will find copy of the 8G changelog included in the zip download file. Check out the nG homepage for install steps and complete information.
License & Disclaimer
8G Firewall is open source and 100% free for all. The only requirement is that the following credit lines are included when using 8G (or any of its parts).
# 8G FIREWALL
# https://perishablepress.com/8g-firewall/Other than that, it’s all yours!
Disclaimer
The 8G Firewall is provided “as-is”, with the intention of helping people protect their sites against bad requests and other malicious activity. The code is open and free to use and modify as long as the first two credit lines remain intact. By using this code you assume all risk and responsibility for anything that happens. So use wisely, test thoroughly, and enjoy the benefits of my work :)
Show support
I spend countless hours developing the nG Firewall. I share it freely and openly with the hope that it will help make the Web a more secure place for everyone.
If you benefit from my work with nG Firewall and would like to show support, consider buying one of my books, such as .htaccess made easy. You’ll get a complete guide to .htaccess, exclusive forum access, and a ton of awesome techniques for configuring, optimizing, and securing your site.
Of course, tweets, likes, links, and shares are super helpful and very much appreciated. Your generous support allows me to continue developing the nG Firewall and other awesome resources for the community. Thank you kindly :)
8G Notes
Any 8G-related notes will be added/updated below..
- Only use 7G or 8G, not both
- 8G is modular: each section can be removed/added as desired
- There is an addon to block AI bots: Ultimate Block List to Stop AI Bots »
- 8G is designed to work flawlessly on any website, not just WordPress
- 8G adds new “HTTP COOKIE” rules
- Please report any strings or user agents that should not be blocked
- Always test well before going live and report any bugs or issues
- If using the “WebP Express” plugin, remove
envfrom Request URI rules - To enable “phpinfo() WP” plugin, remove
phpinfofrom Query String rules - To enable the “Ahrefs” bot, remove
ahrefsfrom User Agent rules - Also note that 8G blocks the W3 Validator (I am unable to figure out why)
WordPress
If you need exact-match search results (i.e., surrounding search terms with quotation marks) when attaching items from the Media Library to a post, make the following edit. Locate this line:
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%22|%27|%3c|%3e|%00)(.*)...And remove %22|, so the line becomes:
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%27|%3c|%3e|%00)(.*)...Joomla
If you use Joomla plugin JCE Pro, make the following edit. Locate this line:
RewriteCond %{REQUEST_URI} (/)(filemanager|htdocs|httpdocs...And remove filemanager|, so the line becomes:
RewriteCond %{REQUEST_URI} (/)(htdocs|httpdocs...Other 8G-related notes will be added here..
Perishable Press is operated by Jeff Starr, a professional web developer and book author with two decades of experience.
Here you will find posts about web development, WordPress, security, and 
204 responses to “8G Firewall”
Hey Jeff, thanks for the firewall!
Unfortunately the LinkedIn bot get’s blocked, which is necessary to place ads there.
I had to remove amazonaws and additionally inserted
before final
[F]in all 8G sections.Any chance to allow the LinkedIn bot in the firewall by default?
Cheers!
Hi Hannes, if you let me know which rule is blocking LinkedIn, I will check it out and maybe remove or modify for the next update.
Hi Jeff, 7G and 8G are in place since long time – with some add-ons/adaptations in htaccess and some own php-scripts. All work wonderfull.
php-scripts I have for:
1. browser-language check: This is given in the HTTP-Header. I accept visitors from EU and US only. By the way, if its empty, this is a strong indication for a proxy.
2. Proxy/VPN/TOR checks: I allow none of these. I request JSON reports via API from 2 external services, this is very effective.
Thank you so much.
Regards Bernd
Hi Bernd, great to hear from you. Sounds like you got it dialed in :)
I would be interested to know the services you have chosen for the Proxy/VPN checks, if you want to share them.
I hope you are doing well.
Hi Jeff
Today I saw a “new” HTTP_USER_AGENT in the logfile:
HTTP_USER_AGENT has an extra \"
Maybe also add a
\\\"on the second row of the HTTP_USER_AGENT part of the firewall;\\\x22is not enoughHave added this to the list for next update, thank you Evert-Jan.
Hi Jeff,
Google Site Kit is returning a false positive making the plugin not usable after latest update of Google Site Kit. More info here: https://wordpress.org/support/topic/cannot-read-properties-of-null-reading-setisonline/
Don’t know why yet or what line causes it but if I found out more, I’ll re-comment.
With regards to my latest comment, the pages blocked are:
Hi Bart, neither of these are blocked by 8G, verify here.
Hi Jeff,
chatgpt can’t read my website, is 8G Firewall blocking the GPT bot?
Or could it be the BBQ Firewall plugin that is blocking it?
Thank you so much.
I’m not sure.. can you let me know 1) the specific user agent, and 2) the URLs that are getting blocked. That way I can investigate and let you know one way or another asap, thank you.
I implemented the AI blocklist via .htaccess with a small number of subtractions (no additions). I received a notice from Yandex Webmaster that some of my pages were down. I checked server logs and saw that Yandex’s search crawler “Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)” was getting 403s.
I tried temporarily removing AI blocklist and saw that YandexBot was able to access pages. Restored AI blocklist and removed the two terms with Yandex and YandexBot was blocked again, suggesting that neither YandexExtended nor Yandex \ Alice were causing the issue. I could not identify which term or term(s) were causing the issue with my set-up. I resolved the issue for now by adding a rule above the blocklist specifically whitelisting YandexBot.
It is not clear to me what was causing the issue since it does not look to me like any of the rules should have affected YandexBot. Moreover, I can confirm that other search crawlers with similar strings (“Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)” and “Mozilla/5.0 (compatible; MojeekBot/0.11; +https://www.mojeek.com/bot.html)” for example) are not affected by the rules on my site. The issue seems to be Yandex-specific for me as far as search crawlers go.
Thanks for reporting, I have added this to the list and will investigate for the next update. I appreciate your feedback, Nicholas.
Hey Jeff,
Thank you for keeping our websites secure for free that’s absolutely amazing work!
I found out a new problem when they referred to the web site through Meta Apps i.e Instagram with a ?fbclid=parameters it says This website firewall blocked by 8G type of error this wasn’t happening before would you please fix the problem?
If you can provide an example of the actual URL that is getting blocked, I can take a look and try to resolve asap. Hint: the string
?fbclid=parametersis not blocked by 8G.Jeff, are there blanks in the useragent strings:
RewriteCond %{HTTP_USER_AGENT} (\.ai|-ai|_ai|ai\.|ai-|ai_|ai=|AddSearchBot|Agentic|AgentQL|Agent\ 3|Agent\ API|AI\ Agent|AI\ Article\ Writer|AI\ Chat|AI\ ConteRegards Bernd.
Hi Bernd, I’m not if I understand the question.. are you asking if there are blanks in the reported user agents, or blanks in the 8G rules? Also your example is from my AI Block List, not 8G.. so even more confusing. Let me know how I can help, thank you.
Issue: I changed how I implemented 8G firewall (moving it to htaccess). After I made the change, I saw that SeznamBot was being blocked in my logs. I then saw it was part of 8G and removed it.
Suggestion: SeznamBot is the user agent for the Seznam search engine crawler. Seznam is an independent Czech-based search engine which maintains its own index and is one of the options in Wutsearch. See the official documentation for the crawler: https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/
Absent some information I am not aware of like the user agent being abused by nefarious actors, I think SeznamBot is a good candidate for consideration for removal from the blacklist. For whatever it is worth, Seznam actually indexed my sites and its bot does not visit my sites too often, so I have not encountered any evidence of bad behavior.
I agree, SeznamBot seems to have faded from abuse. Thank you for bringing it to my attention, I will remove SeznamBot for the next update.
Hi Jeff.
Today Ifound this a lot and not only once in my Apache’s log.
May be it’s a new badbot named socketburst and could be added to the list in next release of the firewall.
Thanks.
185.177.72.0 - - [11/Jan/2026:07:06:23 +0100] "GET /..%5c..%5c..%5c..%5c..%5c..%5cvar/log/apache2/access.log HTTP/1.1" 403 - mydomain.de "-" "socketburst/0.1" "-"I am using the NGINX version from https://github.com/t18d/nG-SetEnvIf
But seems like that version is now exactly the same as your original one. For example
Line 55
Seems not fully there in NGINX version (splitted to multiple rules, and some query is missing, e.g. declare)
Thanks
Hi Jason, the Github version is not mine, so I can’t speak for it. For my own Nginx version, the latest is 7G. You may want to reach out and ask the developer for help if needed.
Thanks, may I know if you will consider release 8G NGINX version? Any ETA at the moment? thanks again
It’s planned, I just need to find the time. Currently scrambling to keep up with everything.