Secure Owl Firewall

Secure Owl Firewall is a fast, lightweight firewall plugin with an advanced rule engine featuring PCRE pattern matching, a transformation pipeline, and JSON-based rule configuration.

Key features:

• JSON-based rules — 100+ default rules covering SQLi, XSS, RCE, LFI, SSRF, Log4Shell, and more
• Transformation pipeline — URL decode, lowercase, normalize path, remove whitespace, HTML entity decode, trim
• Inspection targets — REQUEST_URI, QUERY_STRING, USER_AGENT, REFERER, COOKIE, and POST
• MU-Plugin loader — runs before regular plugins for earliest protection
• Rate limiting — optional transient-based IP and subnet banning
• Login protection — PIN field, speed limit and honeypot on the login form and on login forms embedded in pages to stop brute-force attacks; with a PIN set, repeated failed logins pause logins to that account for a few minutes
• IP whitelist — CIDR/subnet support for both IPv4 and IPv6
• IP blacklist — CIDR/subnet support for both IPv4 and IPv6
• Per-rule toggle — disable individual rules from the admin panel without editing files
• File-based logging — 10MB cap with auto-rotation and protected storage
• Log retention — clears the log after 1, 3 or 6 months, which helps with data minimization (e.g. GDPR)
• IP anonymization — masks visitor IP addresses in the log for privacy

Filter Hooks

The firewall runs before regular plugins and the theme load, so add filters that change how requests are checked (lists, proxies, rules, logging, blocking) in a must-use plugin.

• sswaf_ip_whitelist — array of IPs or CIDR ranges that bypass the firewall
• sswaf_ip_blacklist — array of IPs or CIDR ranges to block before any rules run (the whitelist still wins)
• sswaf_trusted_proxies — array of trusted proxy IPs for X-Forwarded-For
• sswaf_post_scanning — enable POST data inspection (default: true)
• sswaf_json_scanning — enable JSON request body inspection (default: true)
• sswaf_json_max_body — request body size limit for inspection, in bytes
• sswaf_json_skip_authenticated — whether trusted logged-in users are exempt from request body inspection
• sswaf_json_skip_capability — capability that marks a logged-in user as trusted
• sswaf_rules_file — path to the rules JSON file
• sswaf_log_dir — directory of the log file
• sswaf_log_file — path to the log file
• sswaf_log_max_size — log size in bytes at which the log is rotated (default: 10 MB, at most 32 MB)
• sswaf_header_status — HTTP status header for blocked requests
• sswaf_header_connection — Connection header for blocked requests
• sswaf_block_on_engine_error — block requests the rule engine cannot fully check (default: true); return false to only log them
• sswaf_speed_limit_skip — return true to turn the login speed limit off, for login forms that cannot include its hidden fields
• sswaf_before_block — action hook fired before blocking a request
• sswaf_rate_limit_ip_threshold — override IP hit threshold
• sswaf_rate_limit_ip_duration — override IP ban duration
• sswaf_rate_limit_ip_window — override IP counting window
• sswaf_rate_limit_subnet_threshold — override subnet hit threshold
• sswaf_rate_limit_subnet_duration — override subnet ban duration
• sswaf_rate_limit_subnet_window — override subnet counting window

Rate-limit values from filters are kept within the ranges of the settings page.