LW Firewall #6 in Security

LW Firewall Lightweight WordPress firewall — rate-limits endpoints, blocks bots, bans repeat offenders, and adds security headers. The Problem Bots brute-force wp-login.php, flood wp-cron.php and xmlrpc.php, crawl WooCommerce filter combinations, scan for vulnerabilities via 404s, and abuse the REST API — all generating thousands of uncacheable requests that overload your server. How It Works LW Firewall installs an MU-plugin worker that intercepts requests before WordPress fully loads. The processing order: 1. IP Whitelist — whitelisted IPs skip all checks 2. IP Blacklist — blacklisted IPs get 403 immediately 3. Geo Blocking — block entire countries (Cloudflare header or CIDR lookup) 4. Auto-Ban — previously banned IPs get 403 5. 404 Flood — IPs with excessive 404s get 429 6. Bot Blocking — User-Agent matching (all requests) 7. Endpoint Detection — filter params, cron, xmlrpc, login, REST API 8. Rate Limiting — per-IP counters with auto-ban escalation That list is the worker's pre-WordPress path. Registration spam protection, password-reset flood protection and the administrator alerts run inside WordPress instead, because they need the user API — but they share the same st