Wondalizer External Firewall

Version: 8.1.8
Requires at least: WordPress 6.4
Tested up to: WordPress 7.0
Requires PHP: 7.4+
License: GPL-2.0+

A comprehensive external firewall for WordPress that blocks unwanted HTTP/cURL requests, email interception, cron execution, and detects obfuscated code — all with granular per-plugin and per-theme control.

Donate to PayPal.me/Dealazer or look in the main file for other donation link

---

🔥 Features

HTTP / cURL Firewall

• Block or allow external HTTP requests on a per-plugin and per-theme basis
• Domain whitelist and blacklist with wildcard support (*.tracker.com)
• Automatic WordPress core detection — core updates are never blocked
• reCAPTCHA-safe by default — Google domains are whitelisted unless explicitly disabled
• Same-site exception — blocked plugins can still access your own domain (essential for cache plugins)

Email Firewall

• Block or allow email sending (wp_mail(), mail()) per extension
• Independent from HTTP controls — block emails without blocking HTTP
• Full logging of blocked and allowed email attempts

Cron Firewall

• Block all external HTTP requests made during WordPress cron execution (wp-cron.php)
• Whitelist specific cron hooks to allow them internet access
• Prevents blocked plugins from bypassing the firewall via scheduled tasks

cURL Cache Engine (Extension Rewriting)

• Physically rewrites plugin and theme PHP files to intercept:
  • curl_init(), curl_setopt(), curl_setopt_array(), curl_exec()
  • fsockopen(), pfsockopen(), stream_socket_client()
  • mail(), wp_mail()
• Rewritten code routes through WordPress filters for firewall enforcement
• Optional auto-rewrite on plugin/theme activation
• One-click restore to original files

Obfuscation Detection (Bad Potential)

• Detects base64-encoded, hex-encoded, and other obfuscated code patterns
• Assigns threat scores to plugins and themes
• Read-only by default — scan without modifying files
• One-click block all extensions flagged as high risk
• Wondalizer External Firewall is automatically excluded from its own Bad Potential list

Logging & Diagnostics

• Comprehensive logging of all HTTP requests, email attempts, and cron activity
• Color-coded log entries (green = allowed, red = blocked, blue = same-site, purple = email)
• Configurable retention (1–90 days)
• Circuit breaker pattern prevents database overload
• Logger health diagnostics directly in the admin panel

Dashboard Widget

• Real-time statistics on the WordPress dashboard
• Quick overview of HTTP blocked, email activity, and Bad Potential count

MU-Plugin Support

• Optional must-use plugin for early boot protection
• Intercepts requests before plugins fully load
• Maximum security mode for high-risk environments

---

📦 Installation

Standard Installation

1. Upload the plugin files to /wp-content/plugins/wondalizer-external-firewall/
2. Activate the plugin through Plugins → Installed Plugins in WordPress
3. Navigate to External Firewall in the admin sidebar to configure settings

MU-Plugin Installation (Optional, Recommended)

For maximum protection, install the MU helper:

1. Go to External Firewall → Settings
2. Check "I UNDERSTAND that enabling Cache Engine will modify files on disk"
3. Check "Enable Rewrite Engine Master Switch"
4. The plugin will automatically install the MU helper to wp-content/mu-plugins/

---

⚙️ Settings Overview

Explicit Logging Options

• Logging Engine — Master on/off switch for all logging
• HTTP Logs — Log blocked and/or allowed HTTP requests
• Email Logs — Log blocked and/or allowed emails
• Internal HTTP — Log same-site / localhost requests
• cURL Cache Logs — Log all intercepted calls from rewritten plugins
• Log Retention — Auto-cleanup after N days (default: 14)

Domain Controls

• Whitelisted Domains — Always allowed, one per line
• Blocked Domains — Always blocked, supports wildcards
• Auto-Whitelist WordPress Core — One-click add all core domains
• Auto-Whitelist reCAPTCHA — One-click add Google reCAPTCHA domains

Same-Site Connection Control

• Allow Same-Site for Blocked (default: ON) — Essential for cache plugins (WP Rocket, W3 Total Cache, LiteSpeed Cache) that need to warm caches via same-site requests. When disabled, blocked plugins are blocked from all HTTP including your own domain.

Global Blocking Behaviors

• Block ALL new plugins from HTTP by default
• Block ALL new themes from HTTP by default
• Block ALL new plugins from email by default
• Block ALL new themes from email by default

Commerce Whitelists

• WooCommerce — Always allow orders, webhooks, API calls
• Easy Digital Downloads — Always allow purchase receipts
• PayPal — Always allow IPN, PDT, payment confirmations

cURL & Mail Rewrite Engine

• Enable Cache Engine — Master switch for file rewriting
• Granular Rewrites — Enable cURL, Socket, and/or PHP mail() interception separately
• Auto Rewrite — Automatically rewrite on plugin/theme activation and updates

---

🛡️ How It Works

HTTP Request Flow

Plugin makes HTTP request
        ↓
Firewall intercepts via pre_http_request filter
        ↓
Same-site check → allow if enabled and same domain
        ↓
Whitelist check → allow if domain is whitelisted
        ↓
Blacklist check → block if domain is blacklisted
        ↓
Plugin blocklist check → block if plugin is blocked
        ↓
Default behavior → allow or block based on settings
        ↓
Log entry created (if logging enabled)

Email Flow

Plugin calls wp_mail() or mail()
        ↓
Firewall intercepts via pre_wp_mail filter
        ↓
Plugin blocklist check → block if plugin is blocked
        ↓
Default behavior → allow or block based on settings
        ↓
Log entry created (if logging enabled)

Cron Flow

WordPress runs wp-cron.php
        ↓
Cron Firewall is active
        ↓
Hook whitelist check → allow if hook is whitelisted
        ↓
Hook blocklist check → block if hook is blocked
        ↓
Default behavior → allow or block based on settings

---

🎨 Admin Interface

The plugin adds a top-level admin menu External Firewall with these tabs:

Tab	Description
🌐 HTTP Firewall	Per-plugin and per-theme HTTP blocking controls
✉️ Email Control	Per-plugin and per-theme email blocking controls
🔧 cURL Cache	Extension rewriting interface with restore capability
☠️ Bad Potential	Obfuscation detection results with threat scores
⏰ Cron Firewall	Scheduled event management with allow/block lists
⚙️ Settings	All configuration options, logging, domains, whitelists
📄 Logs	Real-time activity feed with color-coded entries
❤️ About	System info, donation link, HearThis player

---

🧪 Frequently Asked Questions

Does this plugin block WordPress core updates?

No. The plugin automatically detects WordPress core requests (api.wordpress.org, downloads.wordpress.org, planet.wordpress.org, etc.) and classifies them appropriately. Core functionality is never blocked.

Will this break my cache plugin?

No — if Same-Site exception is enabled (default). Cache plugins like WP Rocket, W3 Total Cache, and LiteSpeed Cache often make same-site HTTP requests to warm caches or generate static files. The Same-Site exception ensures these continue to work even when the plugin is blocked from external requests.

Will this break my contact forms?

No — if reCAPTCHA whitelist is enabled (default). Google reCAPTCHA and gstatic domains are whitelisted by default. You can disable this in Settings if you want to block them explicitly.

How does the cURL Cache Engine work?

It physically rewrites plugin and theme PHP files to replace raw curl_init(), fsockopen(), mail(), etc. with wrapper functions that route through WordPress filters. This allows the firewall to intercept requests even when plugins bypass standard WordPress APIs. Files can be restored to their original state at any time.

Is the obfuscation detection safe?

Yes — it is read-only by default. The scanner reads plugin/theme files and detects patterns like base64_decode(), hex2bin(), eval(), etc. It does not modify any files. You can then choose to block flagged extensions manually.

Can I export/import settings?

Settings are stored in WordPress options (won2_firewall_settings, won2_blocked_plugins, etc.) and can be exported/imported via standard WordPress backup plugins or WP-CLI.

---

✅ Plugin Check & Compliance Notes

• No remote file loading — the plugin calls no servers at all. All CSS/JS is bundled locally in assets/ and served via wp_enqueue_*; the plugin initiates zero outbound requests of its own and needs no account, API key, or connection to the author's servers. The flagged domain strings are local text data, never fetched: data-domains="google.com|gstatic.com|recaptcha.net" on the reCAPTCHA auto-whitelist button (class-render-settings.php), the same names as a PHP array when saving that preset (class-admin-actions.php), and placeholder.com/placeholder.org in the scanner's FALSE_POSITIVE_DOMAINS ignore-list (class-scan.php).
• cURL usage is the firewall service itself — nothing is ever sent to us. wondalizer-fw-curl-guard.php is a pass-through shim servicing cURL handles that belong to other plugins/themes, rewritten only with the administrator's explicit consent. Every URL is vetted through the WordPress HTTP API's own pre_http_request filter before any handle runs. The raw \curl_exec($ch) cannot be converted to wp_remote_*(): PHP cannot read back the options the originating plugin set on its handle, so reconstruction through the HTTP API would corrupt its requests. http://won1-blocked.invalid/ is an intentionally unresolvable .invalid placeholder used to neutralize blocked handles — never a real call.
• ABSPATH is only used to recognize WordPress core files during source tracing.
• Enqueued assets only: all admin CSS/JS is served via wp_enqueue_style()/wp_enqueue_script() with wp_localize_script() — no inline `