Techbox Firewall

Techbox Firewall is a fast, lightweight Web Application Firewall (WAF) for WordPress. It inspects every request and blocks common attacks — SQL injection, cross-site scripting (XSS), remote code execution, directory traversal, malicious bots, and bad requests. Techbox Firewall is part of the Techbox Shield family and is designed to pair with Techbox Login Security for complete front-door protection: the firewall stops malicious requests, while Login Security guards the login itself. What you get

• WordPress-layer WAF — loads early and screens every request, on any host, no .htaccess or server changes required.
• Core attack rules — SQL injection, XSS, RCE, LFI/RFI, path traversal, malicious user-agents and bad bots, and anomalous requests.
• Signed rule updates — optional (off by default); enable weekly or daily when you want fresher rules, verified before apply.
• Learning mode — on by default so you can watch and log before you enforce.
• IP allow / block lists — block known-bad addresses and allow-list your own office or VPN.
• Activity log — see exactly what was blocked and why, with a clean, plain-English record.
• Safe-mode recovery — a built-in way back if a rule or setting ever gets in your way.

Built for real people, not just developers Security software is often written for experts. Techbox Firewall is different: smart defaults, plain-English settings, and a clear view of what it is blocking — so first-time site owners and seasoned agencies both feel at home.

1.0.3

• Log retention now keeps events for the full 1–365 days offered in settings.
• Choose which header carries the visitor IP behind a proxy or CDN, or leave it on automatic detection.
• The optional rule feed now asks before its first check and names the service it contacts.
• The IP block list explains what it does in the firewall mode you are actually running.
• Security and reliability hardening.
• Compatibility fixes for recent WordPress releases.

1.0.2

• Harden admin output escaping.

1.0.1

• Document Privacy Policy and Terms links for the optional signed rule feed.
• Point Plugin URI at the WordPress.org listing and trim outbound marketing links.

1.0.0

• First public release: WordPress-layer WAF with Basic / Balanced / Strict levels.
• Ships in Monitor mode on Basic by default; switch to Enforce when ready.
• Optional signed rule feed (off by default; weekly or daily when enabled), seed fallback, IP lists, logs, and safe-mode recovery.