peterswe

<p>Your Web Shield blocks high-risk IPs and limits request rates, providing enhanced security for your site.</p>
<h3>External Services</h3>
<p>This plugin relies on the external service “Your Web Shield API” to check IP addresses for risk scoring.<br />
API Documentation: https://www.postman.com/ywspeter/your-web-shield/request/uvtu6ua/ip-details<br />
Terms of Service: https://www.yourwebshield.co.uk/terms<br />
Privacy Policy: https://www.yourwebshield.co.uk/privacy</p>


Your Web Shield

Your Web Shield blocks high-risk IPs and limits request rates, providing enhanced security for your site.

susheelhbti

<p>TrapFlux Request Firewall is a lightweight request firewall that blocks vulnerability scanners and bot floods by <strong>how they behave</strong>, not just where they come from.</p>
<ul>
<li><strong>Behavior-based blocking</strong> — exploit-path probes (<code>.env</code>, <code>wp-config</code> backups, <code>.sql</code> dumps), malicious user agents, and request floods.</li>
<li><strong>Rate limiting</strong> — every visitor is rate limited; hits on exploit paths count double, so scanners get banned far faster than real visitors ever could.</li>
<li><strong>Honeypot traps</strong> — invisible links only bots follow; one visit means a permanent ban.</li>
<li><strong>Subnet bans</strong> — block a whole CIDR range (e.g. <code>20.100.172.0/24</code>) when attackers rotate IPs on cloud providers.</li>
<li><strong>Text attack reports</strong> — one-click downloadable <code>.txt</code> reports (summary + raw log) listing every URL attackers tried to access, ready to hand to your hosting company.</li>
<li><strong>fail2ban-friendly log</strong> — one pipe-delimited line per blocked request, so your host can ban attackers at the network level using the plugin’s detections.</li>
<li><strong>Fails open</strong> — any internal error and your site keeps working normally. An emergency <code>disable.flag</code> file shuts blocking off instantly via FTP.</li>
</ul>
<h4>Strongest mode (optional)</h4>
<p>By default the firewall runs when plugins load — before WP routing, themes and queries. For maximum resource savings you can point PHP’s <code>auto_prepend_file</code> at <code>firewall.php</code> so blocking happens before WordPress loads at all. See the FAQ.</p>
<h4>Honest limitations</h4>
<ul>
<li>This is a request firewall, not a malware scanner — it will not detect an already-infected site.</li>
<li>It ships with rules for today’s common probes and has no cloud threat feed; review the rules occasionally.</li>
<li>The “Block xmlrpc.php” option breaks Jetpack and the WordPress mobile app — disable that single toggle if you use them.</li>
<li>All assets (CSS/JS) are bundled — the plugin makes no external network requests.</li>
</ul>


TrapFlux Request Firewall

Lightweight, behavior-based bot firewall. Blocks scanners before WordPress loads, with text attack reports for your hosting company.

Your Web Shield vs TrapFlux Request Firewall