BBQ Firewall (Free WordPress Plugin)

♦ Posted by Jeff Starr in Security, WordPress

Updated November 24, 2020 • 118 comments

BBQ Firewall is a lightweight, super-fast plugin that protects your site against a wide range of threats. BBQ checks all incoming traffic and quietly blocks bad requests containing nasty stuff like eval(, base64_, and excessively long request-strings. This is a simple yet solid solution for sites that are unable to use a strong Apache/.htaccess firewall.

BBQ Firewall is available as a free or pro WordPress plugin. This post describes the free version of BBQ Firewall. Visit Plugin Planet to learn more about BBQ Pro.

BBQ is the lightest, fastest firewall plugin for WordPress.

Welcome to BBQ

BBQ adds a powerful firewall to your WordPress site. That’s it. No bells. No whistles. No bloat. Just a lean, mean bad-request blocking machine.

To use BBQ on any WordPress-powered site, install and activate the plugin via the WP Admin Area. Then sit back and enjoy the automatic, behind-the-scenes protection and a more secure website. No configuration required, just activate and done. BBQ is 100% plug-&-play, lightweight super fast, super strong WAF firewall.

BBQ adds powerful firewall protection with a few clicks.

Verify BBQ is working

Once BBQ is installed and active, you can verify that it’s working by requesting any of the following URLs (replace example.com with your own domain name).

http://example.com/proc/self/environ
http://example.com/path/?q=%2e%2e
http://example.com/path/base64_

These are just examples of the type of garbage that’s blocked by BBQ. If your server returns a 403 “Forbidden” response for these examples, BBQ is working properly. Silently protecting your site behind the scenes.

Note that additional tests are possible using the patterns contained in the firewall rules, located in the main plugin file, block-bad-queries.php.

Tip: Learn how to customize BBQ’s default firewall rules with free addons.

How BBQ works

BBQ basically is an adaptation of my Apache/.htaccess G-series firewalls ported to PHP/WordPress. The plugin works by defining a set of regular expressions to match and block malicious URL requests. The BBQ firewall rules have been refined and battle tested for years, with false positive rates near zero. It’s a simple, effective, lightweight solution that’s easy on server resources.

BBQ scans the following parts of each request:

The Request URI
The Query String
The User Agent
Referrer

Also for each request, BBQ checks all available request methods, GET, POST, PUT, DELETE, etc. Checking these variables against a strategically crafted set of known attack patterns is an effective way to protect your site against a wide range of threats.

If BBQ detects foul play in any part of the request, it is blocked immediately via 403 “Forbidden” response.

Tip: Check out the BBQ Customize plugin to enable pattern-match logging, customize response headers, and disable blocking of long URI requests.

More information

Check the following articles for more information on the underlying functionality:

More infos on this and related topics in the security and .htaccess archives.

Got BBQ? Get advanced firewall protection with BBQ Pro. BBQ Pro features a settings page with options for customizing firewall rules and much more.

Download BBQ Firewall

Download BBQ from the WordPress Plugin Directory:

Download BBQ Firewall »

Need help? Contact anytime via my contact form.

About the Author

Jeff Starr = Web Developer. Security Specialist. WordPress Buff.

118 responses to “BBQ Firewall (Free WordPress Plugin)”

Ben 2012/10/26 4:55 pm

Sounds great. Just wondering if there is likely to be any performance overhead if all incoming traffic is being checked by the script?

Jeff Starr 2012/10/26 5:20 pm • Post Author

It’s a good question. BBQ is as bare-bones as possible, and should be fine unless you’re getting huge amounts of traffic. For each URI request, the script does a series of comparisons and that’s pretty much it. Not having to communicate with the database helps keep it light.

Keith Davis 2012/10/27 3:25 am

Thanks Jeff
Alerted to this one by John Hoff and use it on all my WordPress sites.

Just updated to latest version.
Appreciate you keeping the plugin updated.

Keith Davis 2012/10/27 3:56 am

Hi Jeff
Just updated BBQ plugin and can’t empty trash comments in WordPress dashboard.

Get the message…

“Access to the web page was denied
You are not authorised to access the web page…”

Easy to deactivate BBQ plugin, empty comments and reactivate plugin, but just letting you know.

Jeff Starr 2012/10/27 3:02 pm • Post Author

It looks like WordPress is using some really long URL requests for comment/trash moderation.. I’d like to collect some examples of any URLs that are causing issues and then see what can be done. Will you post the next URL that leads to the error? (comment out any sensitive infos!) Thanks.
- Keith Davis 2012/10/27 3:38 pm
  
  Will do Jeff.

Grégoire Noyelle 2012/10/27 6:25 am

Hi Jeff
Thanks a lot.
I get a bug when I try to delete all spam, the browser deny access. I was connected as admin. After desactivate the plugin, the delete button works fine.
Thanks

Jeff Starr 2012/10/27 2:58 pm • Post Author

I think that may be due to the long URL requested for spam and trash deletes (anything over 255 characters is blocked). What is the URL and I can take a look..

FxB 2012/10/27 2:01 pm

Already using the 5g blacklist is there a reason to switch to bbq or not

Jeff Starr 2012/10/27 2:55 pm • Post Author

Just a little bit, but the same protection will soon be available in the 6G final, so no need for BBQ if you’re rolling with 5G with plans to update.

Tom 2012/10/27 4:06 pm

Just wanted to add that the new update made it so you couldn’t delete spam comments giving you a 403 error.

Jeff Starr 2012/10/27 4:56 pm • Post Author

Plugin update! I’ve went ahead and disabled the match for long strings, and for the term scanner. This should resolve the errors reported by Danielle, Tom, Grégoire, and Keith. Thanks to those who are providing feedback regarding BBQ. I’ll continue to update the plugin as needed and hopefully find a workaround for protection against long-character strings.

Grégoire Noyelle 2012/10/27 10:39 pm

Thanks Jeff, it works now (delete spams with akismet)
Keith Davis 2012/10/28 3:08 am

Yep, all OK now.
Appreciate that Jeff.
Danielle Signor 2012/10/28 9:27 am

Likewise, everything works fine. Thanks for the update!

Danielle Signor 2012/10/27 4:39 pm

Experiencing similar blocks as others commenting here, the first is another plugin I use, Exploit Scanner (page is blank):

http://silver-rockets.com/wp-admin/tools.php?page=exploit-scanner

Second, when trying to empty my spam comments:

http://silver-rockets.com/wp-admin/edit-comments.php?s=&comment_status=spam&pagegen_timestamp=2012-10-27+23%3A34%3A58&_total=4&_per_page=20&_page=1&_ajax_fetch_list_nonce=d6c23788da&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php%3Fcomment_status%3Dspam&_wpnonce=88bcd416a8&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php%3Fcomment_status%3Dspam&action=-1&comment_type=&_destroy_nonce=a9751cd9c2&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php%3Fcomment_status%3Dspam&delete_all=Empty+Spam&paged=1&action2=-1&_destroy_nonce=a9751cd9c2&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php%3Fcomment_status%3Dspam

Hope that helps you fix the issue, I definitely want to keep using BBQ, but this is a little inconvenient.

Okoth 2012/10/28 2:37 am

Today I did a test with this plugin and the 5G. Turns out with proc/self/environ the plugin gives me a 403 and the code in the root htaccess just a page not found.

Not using them together for testing. Is this right?

Jeff Starr 2012/10/29 12:53 am • Post Author

What is the URL(s) that result in the 403 errors and I’ll take a look..
Okoth 2012/11/03 6:34 pm

I have only the 5G in the root htaccess, no BBQ, and I am trying to get a 403 with http://example.com/hello?Permanent, but the result is 404.

If have sent you my htaccess file by email, subject asdfg htaccess

I’m actually trying to block requests like this that I get a lot lately:

http://example.com/178.137.87.200/%24 and http://example.com/%5ehttp:/94.153.11.224/%24
- Jeff Starr 2012/11/04 2:49 pm • Post Author
  
  Hi Okoth, the 5G blocks the string “Permanent” only when it’s included in the request string (not the query string).
  
  To block requests such as your examples that include an IP address, try adding this to .htaccess:
  
  RedirectMatch 403 /([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/
  
  This is actually a good idea that may end up in the 6G Blacklist.
- Okoth 2012/11/04 3:38 pm
  
  Thanks Jeff. Going to see if they stay out.

Yael K. Miller 2012/10/29 9:37 am

Does this update incorporate your WordPress Add-on for 5G Blacklist?

Jeff Starr 2012/10/29 1:04 pm • Post Author

Yes for the most part. It includes the widest reaching protection from the 5G, 6G, and the WP addon, but it doesn’t include everything.
- Yael K. Miller 2012/10/29 3:56 pm
  
  Thanks for the clarification.