WP Firewall Behavior WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA
Behavioral WAF plugin for WordPress — 44 attack patterns, per-IP scoring with decay, 6 threat levels with auto-response
Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/syamsuddin/wp-firewall-behavior/archive/refs/heads/main.zipBehavioral Web Application Firewall (WAF) plugin for WordPress.
Detects 44 attack patterns across 9 categories, scores each IP based on real-time behavior, and auto-responds with 6 progressive threat levels — from logging to permanent blocking.
Why Behavioral?
Traditional firewalls rely on static IP blocklists. WP Firewall Behavior takes a different approach:
- Every request is analyzed against pattern-matching rules
- Each matched rule adds points to the visitor's IP score
- Scores decay over time — false positives self-heal
- Repeated attacks trigger a burst multiplier (up to 5x)
- Response escalates progressively as the score rises
A legitimate user who mistyped a password once will never reach Level 1. An attacker running a brute-force tool hits Level 4 within seconds.
Threat Levels
| Level | Score | Label | Response |
|---|---|---|---|
| 0 | 0 - 24 | CLEAN | Log only |
| 1 | 25 - 49 | WATCH | Rate limit 30 req/min |
| 2 | 50 - 99 | WARN | Rate limit 10 req/min + CAPTCHA on login |
| 3 | 100 - 199 | RESTRICT | Block wp-admin, wp-login, xmlrpc |
| 4 | 200 - 499 | TEMP_BAN | Block all requests (403), auto-clear 6h |
| 5 | 500+ | PERM_BAN | Permanent block, manual unblock only |
Detection Rules (44 total)
Authentication (8 rules)
| ID | Description | Score | TTL |
|---|---|---|---|
| AUTH-01 | Login failed (wrong password) | 10 | 30m |
| AUTH-02 | Login failed (username doesn't exist) | 15 | 30m |
| AUTH-03 | 5+ login failures in 60 seconds | 50 | 60m |
| AUTH-04 | XML-RPC wp.getUsersBlogs auth failure |
20 | 30m |
| AUTH-05 | XML-RPC system.multicall with 3+ auth calls |
80 | 120m |
| AUTH-06 | Password reset flood (3+ in 5 min) | 30 | 60m |
| AUTH-07 | Login with default username (admin, root, etc.) | 20 | 30m |
| AUTH-08 | Login with common/leaked password | 25 | 30m |
Injection (7 rules)
| ID | Description | Score | TTL |
|---|---|---|---|
| INJ-01 | SQL injection (UNION SELECT, OR 1=1, SLEEP, etc.) | 50 | 120m |
| INJ-02 | XSS payload (\ |
Releases
3 releases.
These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.