Filter Suspicious Queries is the free Web Application Firewall layer in Security Ninja. It inspects incoming requests and blocks many common exploit patterns before they reach WordPress.
The rules are based on the 8G Firewall by Jeff Starr (Perishable Press), adapted for WordPress.
Where to enable it
- Go to Security Ninja → Firewall.
- Open the Settings tab.
- Turn on Filter Suspicious Queries.
This toggle is available in the free plugin. You do not need Pro to use it.
What it checks
When enabled, Security Ninja filters suspicious patterns in:
- Request URI
- Query string
- User agent
- Referrer
These checks run on their own. They are separate from Cloud Firewall bad-IP lists, country blocking, and Prevent Banned IPs from Accessing the Site (Pro).
Hostname reverse-DNS checks
The 8G ruleset can also match visitor hostnames from reverse-DNS lookups. In current versions, hostname checks are off by default. URI, query string, user agent, and referrer rules still run without them.
Hostname matching was a common source of false positives on ordinary browser traffic. Developers who need the old behavior can re-enable it with the secnin_cf_check_blocked_hosts filter.
To customize hostname, URI, query, or referrer lists, see Customizing firewall filter rules and Filter blocked_hosts_items.
Temporary login plugins
Recognized temporary-login links skip the query filter when the matching plugin is active:
- Temporary Login Without Password
- One Time Login
- Magic Login
- Login Links
Those URLs use token query parameters that can look like exploit patterns. Security Ninja allows them through only when the plugin is installed and active. Details: Temporary login plugins.
