{
  "slug":        "firewall",
  "properties":  {
    "slug":                  "firewall",
    "load_priority":         1000,
    "name":                  "Firewall",
    "sidebar_name":          "Firewall",
    "show_module_menu_item": false,
    "show_module_options":   true,
    "storage_key":           "firewall",
    "tagline":               "Automatically block malicious HTTP requests and data sent to your site",
    "show_central":          true,
    "access_restricted":     true,
    "premium":               false,
    "run_if_whitelisted":    false,
    "run_if_verified_bot":   false,
    "run_if_wpcli":          false,
    "order":                 30
  },
  "menus":       {
    "config_menu_priority": 44
  },
  "wpcli":       {
    "enabled": true
  },
  "sections":    [
    {
      "primary":     true,
      "slug":        "section_firewall_blocking_options",
      "module":      "firewall",
      "title":       "Firewall Blocking Options",
      "title_short": "Firewall Blocking",
      "beacon_id":   333,
      "summary":     [
        "Here you choose what kind of malicious data to scan for.",
        "Recommendation - Turn on as many options here as you can. If you find an incompatibility or something stops working, un-check 1 option at a time until you find the problem or review the Activity Log."
      ]
    },
    {
      "slug":        "section_choose_firewall_block_response",
      "module":      "firewall",
      "title":       "Choose Firewall Block Response",
      "title_short": "Firewall Response",
      "beacon_id":   334,
      "summary":     [
        "Here you choose how the plugin will respond when it detects malicious data.",
        "Recommendation - Choose the option 'Die With Message'."
      ]
    },
    {
      "slug":        "section_whitelist",
      "module":      "firewall",
      "title":       "Whitelists - IPs, Pages, Parameters, and Users that bypass the Firewall",
      "title_short": "Whitelist",
      "beacon_id":   335,
      "summary":     [
        "In principle you should not need to whitelist anything or anyone unless you have discovered a collision with another plugin.",
        "Recommendation - Do not whitelist anything unless you are confident in what you are doing."
      ]
    },
    {
      "slug":        "section_enable_plugin_feature_wordpress_firewall",
      "module":      "firewall",
      "title":       "Enable Module: Firewall",
      "title_short": "Disable Module",
      "beacon_id":   253,
      "summary":     [
        "Purpose - The Firewall is designed to analyse data sent to your website and block any requests that appear to be malicious.",
        "Recommendation - Keep the Firewall feature turned on."
      ]
    },
    {
      "slug":   "section_non_ui",
      "hidden": true
    }
  ],
  "options":     [
    {
      "key":         "enable_firewall",
      "section":     "section_enable_plugin_feature_wordpress_firewall",
      "advanced":    true,
      "default":     "Y",
      "type":        "checkbox",
      "link_info":   "https://shsec.io/43",
      "link_blog":   "https://shsec.io/wpsf01",
      "beacon_id":   253,
      "name":        "Enable Firewall",
      "summary":     "Enable (or Disable) The Firewall module",
      "description": "Un-Checking this option will completely disable the Firewall module"
    },
    {
      "key":         "block_dir_traversal",
      "section":     "section_firewall_blocking_options",
      "default":     "Y",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "Directory Traversals",
      "summary":     "Block Directory Traversals",
      "description": "This will block directory traversal paths in in application parameters."
    },
    {
      "key":         "block_sql_queries",
      "section":     "section_firewall_blocking_options",
      "default":     "Y",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "SQL Queries",
      "summary":     "Block SQL Queries",
      "description": "This will block SQL in application parameters."
    },
    {
      "key":         "block_wordpress_terms",
      "section":     "section_firewall_blocking_options",
      "default":     "N",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "WordPress Terms",
      "summary":     "Block WordPress Specific Terms",
      "description": "This will block WordPress specific terms in application parameters (wp_, user_login, etc.)."
    },
    {
      "key":         "block_field_truncation",
      "section":     "section_firewall_blocking_options",
      "default":     "Y",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "Field Truncation",
      "summary":     "Block Field Truncation Attacks",
      "description": "This will block field truncation attacks in application parameters"
    },
    {
      "key":         "block_php_code",
      "section":     "section_firewall_blocking_options",
      "default":     "N",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "PHP Code",
      "summary":     "Block PHP Code Includes",
      "description": "This will block any data that appears to try and include PHP files. Will probably block saving within the Plugin/Theme file editors."
    },
    {
      "key":         "block_exe_file_uploads",
      "section":     "section_firewall_blocking_options",
      "default":     "N",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "Exe File Uploads",
      "summary":     "Block Executable File Uploads",
      "description": "This will block executable file uploads (.php, .exe, etc.)."
    },
    {
      "key":         "block_aggressive",
      "section":     "section_firewall_blocking_options",
      "advanced":    true,
      "default":     "N",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "Aggressive Scan",
      "summary":     "Aggressively Block Data",
      "description": "Employs a set of aggressive rules to detect and block malicious data submitted to your site. Warning - May cause an increase in false-positive firewall blocks."
    },
    {
      "key":           "block_response",
      "section":       "section_choose_firewall_block_response",
      "advanced":      true,
      "default":       "redirect_die_message",
      "type":          "select",
      "value_options": [
        {
          "value_key": "redirect_die_message",
          "text":      "Die With Message"
        },
        {
          "value_key": "redirect_die",
          "text":      "Die"
        },
        {
          "value_key": "redirect_home",
          "text":      "Redirect To Home Page"
        },
        {
          "value_key": "redirect_404",
          "text":      "Return 404"
        }
      ],
      "beacon_id":     334,
      "link_info":     "",
      "link_blog":     "",
      "name":          "Block Response",
      "summary":       "How the firewall responds when it blocks a request",
      "description":   "We recommend dying with a message so you know what might have occurred when the firewall blocks you."
    },
    {
      "key":         "block_send_email",
      "section":     "section_choose_firewall_block_response",
      "default":     "N",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "Send Email Report",
      "summary":     "When a visitor is blocked the firewall will send an email to the configured email address",
      "description": "Use with caution - if you get hit by automated bots you may send out too many emails and you could get blocked by your host."
    },
    {
      "key":         "page_params_whitelist",
      "section":     "section_whitelist",
      "advanced":    true,
      "default":     "",
      "type":        "comma_separated_lists",
      "link_info":   "https://shsec.io/2a",
      "link_blog":   "",
      "beacon_id":   335,
      "name":        "Whitelist Parameters",
      "summary":     "Detail pages and parameters that are whitelisted (ignored by the firewall)",
      "description": "This should be used with caution and you should only provide parameter names that you must have excluded"
    },
    {
      "key":         "whitelist_admins",
      "section":     "section_whitelist",
      "advanced":    true,
      "default":     "N",
      "type":        "checkbox",
      "link_info":   "",
      "link_blog":   "",
      "name":        "Ignore Administrators",
      "summary":     "Ignore Administrators",
      "description": "Authenticated administrator users will not be processed by the firewall rules."
    }
  ],
  "definitions": {
    "whitelisted_paths": [
      "/wp-admin/options-general.php",
      "/wp-admin/post-new.php",
      "/wp-admin/page-new",
      "/wp-admin/link-add.php",
      "/wp-admin/media-upload.php",
      "/wp-admin/page.php",
      "/wp-admin/admin-ajax.php"
    ],
    "default_whitelist": {
      "*":                           [
        "#^wordpress_logged_in_[0-9a-f]+$#",
        "#^et_.*#",
        "#^affwp_action$#i",
        "#^ajaxurl$#i",
        "#^g-recaptcha-response$#i",
        "#^verify_sign$#i",
        "#^txn_id$#i",
        "#^wp_http_referer$#i",
        "#^_wp_http_referer$#i",
        "#^_wp_original_http_referer$#i",
        "#^JCS_INENREF$#i",
        "#^pass1$#i",
        "#^pass1-text$#i",
        "#^pwd$#i",
        "#^url$#i",
        "#^referredby$#i",
        "#^return$#i",
        "#^redirect_to$#i",
        "#^jetpack_sso_original_request$#i",
        "#^jetpack_sso_redirect_to$#i",
        "#^edd_action$#i",
        "#^edd_redirect$#i",
        "#^wpcf7-form$#i",
        "#^yoast_wpseo_metadesc$#i",
        "#^icwp_wpsf_passkey_otp$#i",
        "#^_rest_url$#i",
        "#^shield_action$#i",
        "#^appId$#i",
        "#^ping_sites$#i",
        "#^aioseo-post-settings$#i",
        "#^joe-chnlcustid$#i",
        "#^spd-custhash$#i",
        "#^joe-custinfo$#i",
        "#^_wpcf7cf_hidden_group_fields$#i",
        "#^wl_homeurl$#i",
        "#^_gform_setting_routing$#i",
        "#^where$#i",
        "#^customized$#i"
      ],
      "/wp-admin/options.php":       [
        "#^home#i",
        "#^siteurl#i"
      ],
      "/wp-admin/plugins.php":       [
        "#^plugin#i"
      ],
      "/wp-admin/admin.php":         [
        "#^page#i"
      ],
      "/wp-admin/post.php":          [
        "#^content#i"
      ],
      "/wp-admin/plugin-editor.php": [
        "#^newcontent#i"
      ],
      "/wp-comments-post.php":       [
        "#^url#i",
        "#^comment$#i"
      ]
    },
    "firewall_patterns": {
      "dir_traversal":    [
        "#etc/passwd#i",
        "#proc/self/environ#i",
        "#etc/passwd#i",
        "#makefile#i",
        "#wwwroot#i",
        "#pingserver#i",
        "#\\.\\./#i",
        "#loopback#i"
      ],
      "wordpress_terms":  [
        "#/\\*\\*/#i",
        "#wp-config.php#i",
        "#^user_login#",
        "#^user_pass#"
      ],
      "field_truncation": [
        "#\\s{49,}#",
        "#\\x00#"
      ],
      "sql_queries":      [
        "#concat\\s*\\(#i",
        "#group_concat#i",
        "#union.*select#i"
      ],
      "exe_file_uploads": [
        "#\\.(dll|rb|py|exe|php[3-9]?|pl|perl|ph[34]|phl|phtml|phtm|sql|ini|jsp|asp|git|svn|tar)$#i"
      ],
      "php_code":         [
        "#(include|include_once|require|require_once)\\s*\\(.*\\)#"
      ],
      "aggressive":       [
        "#eval\\(#i",
        "#\\(null\\)#i",
        "#base64\\_#i",
        "#localhost#i",
        "#\\(function\\(#i",
        "#\\{x\\.html\\(#i",
        "#\\)\\.html\\(#i",
        "#\\.\\.\\.#i",
        "#/httpdocs/#i",
        "#/tmp/#i",
        "#boot\\.ini#i",
        "#GLOBALS(=|\\[|%%)#",
        "#REQUEST(=|\\[|%%)#",
        "#(`|\\<|\\>|\\[|\\]|\\{|\\}|\\?)#",
        "#drop\\s+table\\s+(`|'?)[a-z0-9]+\\1#i",
        "#'\\s+OR\\s+'([a-z0-9]+)'\\s*=\\s*'\\1'\\s+(--|\\(\\{|\\/\\*)\\s+#"
      ]
    },
    "events":            {
      "firewall_block":   {
        "audit_params": [
          "name",
          "term",
          "param",
          "value",
          "scan",
          "type"
        ],
        "level":        "warning",
        "recent":       true,
        "offense":      true
      },
      "fw_email_fail":    {
        "audit_params": [
          "to"
        ],
        "level":        "warning",
        "stat":         false
      },
      "fw_email_success": {
        "audit_params": [
          "to"
        ],
        "level":        "debug",
        "stat":         false
      }
    }
  }
}