Setting it up, and knowing it is working

Install

Download nolimit-security.zip from the latest release in this repository and install it the ordinary way (Plugins → Add New → Upload Plugin). Once it is installed, WordPress offers later versions in Dashboard → Updates like any other plugin; there is nothing else to configure.

On activation the plugin creates its tables and schedules its jobs. There is no wizard, and the firewall does nothing you have not looked at first.

The settings that actually require a decision

There are ten groups and over a hundred settings. Almost all of them have a default that is right. These are the ones worth reading before the site takes money.

The allow-list — do this first

Security → Firewall → Blocks → Never blocked. Put your own address in it. It is checked before every other rule, so it is how you get back in when something goes wrong, and it is the only thing that works when a rule has locked you out of wp-admin. Find your address on the Overview screen (Your connection) rather than guessing — a site behind Cloudflare does not see what you think it sees.

An allow-listed address is also never reported as suspicious to other plugins, which is the behaviour you want: a verdict that outlives the allow-list takes back the thing the allow-list is for.

Watching mode before refusing

Security → Firewall → Rules → What to do when a rule matches. Record it and let it through logs what would have been refused without refusing it. Run a day in watching mode on a shop with real traffic and read Activity before switching to Refuse the request. The cost of being wrong here is a customer who cannot check out.

Rate limiting — 240 requests per 60 seconds

Security → Firewall → Rate limiting. Counted per address, not per path. A shared office or a school network is one address as far as this counter is concerned, so raise the limit rather than lower it if a real visitor complains. Verified crawlers are exempt.

Countries — off by default, and read the mode twice

Security → Firewall → Countries. Block refuses the countries in the list. Allow refuses everything not in it. The second is the one that locks out a customer on holiday, so decide which question you are answering before you fill in the list. Putting checkout outside the scope is usually right.

Failed sign-ins and two-factor

Security → Login. The lockout length is shown to the person who is locked out, so it is written in plain words. Two-factor is enrolled by each user on their own profile; there is deliberately no way to enrol it on somebody else's behalf, because a second factor another person set up is not a second factor.

The secrets

The AI provider key, the alert webhook address and a vulnerability-data key (optional) are kept in a separate, non-autoloaded option, so they are not on the row WordPress reads on every request. The screens show a mask rather than the value, and submitting the mask unchanged leaves the stored key alone.

None of them is required. With no AI key the analyst is simply absent; with no webhook nothing is posted anywhere.

How to tell it is working

Do not read "no errors". Read these.

Check	Where	What a working site shows
The firewall is actually running	Overview → This site's protection	Firewall: blocking, and a named state on every row.
It is seeing traffic	Overview → Requests blocked, and Activity	A non-zero number on any site with visitors. Zero means two things — a quiet site and a broken counter — so compare it with Firewall → Blocks, which is written by a different path.
Blocking works end to end	Firewall → Blocks: add a test address that is not yours, then visit from it	A refusal page, and the block appearing in Activity. If the page loads normally, the early file is not installed or a cache is serving around it.
It runs before the rest of WordPress	Overview → Runs before other plugins	yes. This is the half that loads first, so it is also the half a cache plugin can quietly replace. Switch it on under Firewall → Rules.
The scanner has run	Scanner → Findings	A Last scanned timestamp. A scan that has never run and a scan that found nothing both read "no findings", so look for the time.
The AI analyst is configured	AI analyst	A model name it actually fetched from the provider, not just a saved key. A wrong key is stored exactly as happily as a right one.

If you are locked out

Three ways back in, in the order to try them. They are also written on Settings → When something has gone wrong.

The kill switch. Add this line to wp-config.php over FTP, SSH or a file manager. It switches off every blocking decision and leaves the screens working, so the setting that caused the lockout can be found and changed. Nothing in the database can override it.
```
define( 'NLSEC_DISABLE', true );
```

WP-CLI. wp nlsec is registered as a command and reaches the same things from the shell:

wp nlsec status
wp nlsec unblock 203.0.113.9 --allow
wp nlsec panic                  # every blocking feature off at once
wp nlsec 2fa reset username     # clear a lost second factor
wp nlsec verify                 # do all the rules still compile?

Settings → Buttons → Remove every automatic block, once you are back in.

5.4 KiB Raw Blame History