內容簡介
Techbox Firewall 是一款快速且輕量的 WordPress 網路應用程式防火牆（WAF），能夠檢查每一個請求並阻擋常見攻擊，如 SQL 注入、跨站腳本（XSS）等，提供網站全面的安全防護。
【主要功能】
• 早期加載的 WAF，無需伺服器更改
• 核心攻擊規則，防範多種攻擊
• 可選的簽名規則更新，保持防護新鮮
• 學習模式，便於監控與記錄
• IP 允許/封鎖列表，管理訪問權限
• 活動日誌，清晰記錄被阻擋的請求
外掛標籤
開發者團隊
原文外掛簡介
Techbox Firewall is a fast, lightweight Web Application Firewall (WAF) for WordPress. It inspects every
request and blocks common attacks — SQL injection, cross-site scripting (XSS), remote code execution,
directory traversal, malicious bots, and bad requests.
Techbox Firewall is part of the Techbox Shield family and is designed to pair with
Techbox Login Security for complete front-door
protection: the firewall stops malicious requests, while Login Security guards the login itself.
What you get
WordPress-layer WAF — loads early and screens every request, on any host, no .htaccess or server
changes required.
Core attack rules — SQL injection, XSS, RCE, LFI/RFI, path traversal, malicious user-agents and
bad bots, and anomalous requests.
Signed rule updates — optional (off by default); enable weekly or daily when you want fresher rules, verified before apply.
Learning mode — on by default so you can watch and log before you enforce.
IP allow / block lists — block known-bad addresses and allow-list your own office or VPN.
Activity log — see exactly what was blocked and why, with a clean, plain-English record.
Safe-mode recovery — a built-in way back if a rule or setting ever gets in your way.
Built for real people, not just developers
Security software is often written for experts. Techbox Firewall is different: smart defaults,
plain-English settings, and a clear view of what it is blocking — so first-time site owners and seasoned
agencies both feel at home.
Privacy
Firewall logs, IP lists, and settings stay on your WordPress site. Logs may include IP addresses,
request paths, and matched rule IDs so you can audit blocks — remove or restrict access if your
policies require it.
Our website Privacy Policy: https://techboxdesign.com/privacy-policy/
External services
This plugin can optionally download fresher attack-detection signatures from a feed service
operated by Techbox Design. It is off on a fresh install and stays off until you switch it on.
Service: https://feeds.techboxdesign.com/firewall/v1/ — a JSON signature document plus a
detached signature file.
When: Only after an administrator turns on Allow this site to contact the Techbox
signature feed under Firewall → Rule updates. With that off, the plugin makes no request to
the service at all, from any trigger. With it on, you choose between manual checks only, weekly,
or daily.
Data sent: An ordinary HTTPS GET via the WordPress HTTP API. No account, no licence key, and
no visitor personal data.
What comes back: Detection signature data — a match expression per entry, plus a category,
a score, and which parts of a request to inspect. Every field is validated against an allow-list
and the document’s signature is verified before anything is stored. Nothing downloaded is
executed, evaluated, included, or unserialised, and no plugin, theme, or add-on is installed or
updated by this service. Plugin updates come from WordPress.org only.
If it is unavailable: The signatures bundled with the plugin are always active, so protection
does not depend on this service being reachable or enabled.
Terms of Use: https://techboxdesign.com/terms-and-conditions/ (see “Optional signed rule
feed”)
Privacy Policy: https://techboxdesign.com/privacy-policy/
You can withdraw permission at any time; doing so also cancels any schedule.
Third-party notices
This plugin may receive translated derivatives of the OWASP Core Rule Set
(Apache License 2.0) through its signed rule feed. Upstream project:
https://github.com/coreruleset/coreruleset — copyright CRS project contributors; see the upstream
LICENSE for the full Apache License 2.0 text. We do not embed ModSecurity; only portable
signatures are translated into Techbox’s JSON rule format and delivered via the signed feed.
