內容簡介
Secure Owl Firewall 是一款快速且輕量的防火牆外掛，具備先進的規則引擎，能有效防範各種網路攻擊，並提供靈活的規則設定與日誌管理功能，提升網站的安全性。
【主要功能】
• 100+ 預設規則，防範 SQLi、XSS 等攻擊
• URL 解碼、路徑正規化等轉換管道
• 支援 IPv4 和 IPv6 的 IP 白名單與黑名單
• 登入保護功能，防止暴力破解攻擊
• 可配置的日誌保留政策，符合 GDPR
• 每條規則可在控制台中單獨啟用或停用
外掛標籤
開發者團隊
📦 歷史版本下載
原文外掛簡介
Secure Owl Firewall is a fast, lightweight firewall plugin with an advanced rule engine featuring PCRE pattern matching, a transformation pipeline, and JSON-based rule configuration.
Key features:
JSON-based rules — 100+ default rules covering SQLi, XSS, RCE, LFI, SSRF, Log4Shell, and more
Transformation pipeline — URL decode, lowercase, normalize path, remove whitespace, HTML entity decode, trim
Inspection targets — REQUEST_URI, QUERY_STRING, USER_AGENT, REFERER, COOKIE, and POST
MU-Plugin loader — runs before regular plugins for earliest protection
Rate limiting — optional transient-based IP and subnet banning
Login protection — PIN field, speed limit and honeypot on the login form and on login forms embedded in pages to stop brute-force attacks; with a PIN set, repeated failed logins pause logins to that account for a few minutes
IP whitelist — CIDR/subnet support for both IPv4 and IPv6
IP blacklist — CIDR/subnet support for both IPv4 and IPv6
Per-rule toggle — disable individual rules from the admin panel without editing files
File-based logging — 10MB cap with auto-rotation and protected storage
Log retention — clears the log after 1, 3 or 6 months, which helps with data minimization (e.g. GDPR)
IP anonymization — masks visitor IP addresses in the log for privacy
Filter Hooks
The firewall runs before regular plugins and the theme load, so add filters that change how requests are checked (lists, proxies, rules, logging, blocking) in a must-use plugin.
sswaf_ip_whitelist — array of IPs or CIDR ranges that bypass the firewall
sswaf_ip_blacklist — array of IPs or CIDR ranges to block before any rules run (the whitelist still wins)
sswaf_trusted_proxies — array of trusted proxy IPs for X-Forwarded-For
sswaf_post_scanning — enable POST data inspection (default: true)
sswaf_json_scanning — enable JSON request body inspection (default: true)
sswaf_json_max_body — request body size limit for inspection, in bytes
sswaf_json_skip_authenticated — whether trusted logged-in users are exempt from request body inspection
sswaf_json_skip_capability — capability that marks a logged-in user as trusted
sswaf_rules_file — path to the rules JSON file
sswaf_log_dir — directory of the log file
sswaf_log_file — path to the log file
sswaf_log_max_size — log size in bytes at which the log is rotated (default: 10 MB, at most 32 MB)
sswaf_header_status — HTTP status header for blocked requests
sswaf_header_connection — Connection header for blocked requests
sswaf_block_on_engine_error — block requests the rule engine cannot fully check (default: true); return false to only log them
sswaf_speed_limit_skip — return true to turn the login speed limit off, for login forms that cannot include its hidden fields
sswaf_before_block — action hook fired before blocking a request
sswaf_rate_limit_ip_threshold — override IP hit threshold
sswaf_rate_limit_ip_duration — override IP ban duration
sswaf_rate_limit_ip_window — override IP counting window
sswaf_rate_limit_subnet_threshold — override subnet hit threshold
sswaf_rate_limit_subnet_duration — override subnet ban duration
sswaf_rate_limit_subnet_window — override subnet counting window
Rate-limit values from filters are kept within the ranges of the settings page.
