8G Firewall Rules and Learning Mode

8G Firewall Rules and Learning Mode

What It Does

SecuPress’s Web Application Firewall (WAF) filters incoming requests through three protections: Block Bad User Agents, Block Bad Content, and Block Bad Referers.

The 8G signatures checkbox (SecuPress Pro) adds the 8G Firewall signature pack from Perishable Press to the filters you selected. These signatures inspect query strings, URIs, hosts, cookies, User-Agents, and referers.

Firewall Learning Mode adapts those 8G signatures to your site instead of blocking blindly. While Learning Mode runs:

  • calibratable signatures (often too broad for some legitimate traffic) are only observed — they do not block yet;
  • critical exploits are always blocked.

When the period ends, SecuPress lets you review observed signatures: allow them for the site, or keep blocking them. Some safe URI prefixes may be auto-allowed.

Why It Matters

Automated attacks constantly target WordPress (SQL injection, XSS, scanners, malicious bots, and more).

8G signatures greatly strengthen filtering, but a generic pack can also hit legitimate traffic (tools, plugins, crawlers). Learning Mode reduces false positives by calibrating the WAF on real site traffic, without lowering protection against critical threats.

How to Use

Open the WAF & GeoIP module in SecuPress settings, Web Application Firewall section.

  1. Enable one or more filters: Block Bad User Agents, Block Bad Content, Block Bad Referers.
  2. Check Yes, add 8G signatures to the selected filters, then save. Without this option (and without saving), Learning Mode is not available.
  3. Choose a duration (1 to 5 days, 5 by default) and click Start Learning Mode.

While Learning Mode runs:

  • a progress bar waits for a traffic sample (about 20 hours and 200 requests) before showing suggestions;
  • you can Extend the period, Finish now, or Skip & block everything (enforce all without review);
  • for each listed signature: Allow (site-wide exception) or Keep blocking. An Allow / Block suggestion may appear once the sample is large enough.

SecuPress may also propose a short Learning Mode after a new third-party plugin is activated, or after a WordPress core update, so filters can be recalibrated.

Learning Mode requires SecuPress Pro and at least one of the three filters above with 8G signatures enabled.