Filter Suspicious Queries is the free Web Application Firewall layer in Security Ninja. It inspects incoming requests and blocks many common exploit patterns before they reach WordPress.
The rules are based on the 8G Firewall by Jeff Starr (Perishable Press), adapted for WordPress.
Where to enable it
- Go to Security Ninja → Firewall.
- Open the Settings tab.
- Turn on Filter Suspicious Queries.
This toggle is available in the free plugin. You do not need Pro to use it.
What it checks
When enabled, Security Ninja filters suspicious patterns in:
- Request URI
- Query string
- User agent
- Referrer
These checks run on their own. They are separate from Cloud Firewall bad-IP lists, country blocking, and Prevent Banned IPs from Accessing the Site (Pro).
The request path and the query string are checked separately. A long token in a query string (a WooCommerce download link, for example) is not treated as an exploit path.
Ordinary text that is not an attack
The rules look for exploit shapes, not for English words that happen to contain the same letters.
- A person’s name such as “Charlotte (Charlie)” is not a function call.
char(),eval(), andbenchmark()are still blocked. The name has to stand on its own and be followed by a parenthesis. Words such as “evaluation” or “medieval” are noteval(). - A phrase such as “please select one” is not SQL.
select,insert,update, anddeleteare still blocked when SQL follows, such asFROM,INTO, orSET. - A parameter that only ends in
_request, such asdownload_request, is not treated as access to PHP’s request array. - A bare
...in a query value (a masked card number, or text cut short) is not path traversal. Real traversal such as../,..\\, and encoded variants is still blocked.
If a real checkout or webhook is still blocked, see WooCommerce and SureCart store protection. On those payment requests, a few query rules that trip on tokens are skipped. The rest of the firewall still runs.
Early Firewall
On Pro, Early Firewall can run these same rules before WordPress loads. The rules are compiled into a config when you enable it, when you save Firewall settings, and after a plugin update. That compiled config is what Early Firewall uses. The WordPress-hooks firewall still evaluates the filters on each request.
If you change a rule with a filter, save Firewall settings or click Verify on the Early Firewall panel so the compiled config picks it up. A filter that only changes its result when a certain query argument is present can be saved for every visitor. Use a fixed change. Details: Customizing firewall filter rules.
Hostname reverse-DNS checks
The 8G ruleset can also match visitor hostnames from reverse-DNS lookups. In current versions, hostname checks are off by default. URI, query string, user agent, and referrer rules still run without them.
Hostname matching was a common source of false positives on ordinary browser traffic. Developers who need the old behavior can re-enable it with the secnin_cf_check_blocked_hosts filter.
To customize hostname, URI, query, or referrer lists, see Customizing firewall filter rules and Filter blocked_hosts_items.
Temporary login plugins
Recognized temporary-login links skip the query filter when the matching plugin is active:
- Temporary Login Without Password
- One Time Login
- Magic Login
- Login Links
Those URLs use token query parameters that can look like exploit patterns. Security Ninja allows them through only when the plugin is installed and active. Details: Temporary login plugins.
