Bad request filter

Why should your site answer ../?

The filter looks at requests before WordPress processes them. Classic attack patterns such as SQL injection, XSS, ../ and php:// are rejected. Logged-in administrators are exempt, so the filter does not get in your way while you work.

Get lifetime — €149 All Security features

All eight plugins included in the lifetime deal — every future one too.

Bad request filter

Blocks SQL injection patterns · Detects XSS, ../ and php://

ActiveSettings

What the bad request filter offers

Blocks SQL injection patterns

Detects XSS, ../ and php://

Scanner bots can be turned away with 403

Logged-in admins are excluded

Here's how it works

A request comes in

Pattern check ahead of WordPress

A hit is rejected

FAQ about the bad request filter

Which patterns does the filter detect?

Classic attack patterns: SQL injection, XSS, path traversal with ../ and php:// wrappers. If a request matches, it is rejected before WordPress answers it.

Does the filter block me too?

Logged-in administrators are exempt. So a post with conspicuous code in the editor stays possible.

What about sqlmap or nikto?

Known scanners such as sqlmap, nikto or nmap can additionally be turned away with 403. You switch that on separately from the pattern filter.

More Security features

Ready?

Security — pay once, use forever.

All eight plugins for a one-time €149 instead of €13 a month. Secure payment via Stripe. For the first 14 days, it's problem fixed or your money back.

Get lifetime — €149