110 lines
5.4 KiB
Markdown
110 lines
5.4 KiB
Markdown
# Setting it up, and knowing it is working
|
|
|
|
## Install
|
|
|
|
Download `nolimit-security.zip` from the latest release in this repository and
|
|
install it the ordinary way (**Plugins → Add New → Upload Plugin**). Once it is
|
|
installed, WordPress offers later versions in **Dashboard → Updates** like any
|
|
other plugin; there is nothing else to configure.
|
|
|
|
On activation the plugin creates its tables and schedules its jobs. There is no
|
|
wizard, and the firewall does nothing you have not looked at first.
|
|
|
|
## The settings that actually require a decision
|
|
|
|
There are ten groups and over a hundred settings. Almost all of them have a
|
|
default that is right. These are the ones worth reading before the site takes
|
|
money.
|
|
|
|
### The allow-list — do this first
|
|
|
|
**Security → Firewall → Blocks → Never blocked.** Put your own address in it.
|
|
It is checked **before every other rule**, so it is how you get back in when
|
|
something goes wrong, and it is the only thing that works when a rule has
|
|
locked you out of wp-admin. Find your address on the **Overview** screen
|
|
(*Your connection*) rather than guessing — a site behind Cloudflare does not
|
|
see what you think it sees.
|
|
|
|
An allow-listed address is also never reported as suspicious to other plugins,
|
|
which is the behaviour you want: a verdict that outlives the allow-list takes
|
|
back the thing the allow-list is for.
|
|
|
|
### Watching mode before refusing
|
|
|
|
**Security → Firewall → Rules → What to do when a rule matches.** *Record it
|
|
and let it through* logs what would have been refused without refusing it. Run
|
|
a day in watching mode on a shop with real traffic and read **Activity** before
|
|
switching to *Refuse the request*. The cost of being wrong here is a customer
|
|
who cannot check out.
|
|
|
|
### Rate limiting — 240 requests per 60 seconds
|
|
|
|
**Security → Firewall → Rate limiting.** Counted per **address**, not per path.
|
|
A shared office or a school network is one address as far as this counter is
|
|
concerned, so raise the limit rather than lower it if a real visitor
|
|
complains. Verified crawlers are exempt.
|
|
|
|
### Countries — off by default, and read the mode twice
|
|
|
|
**Security → Firewall → Countries.** *Block* refuses the countries in the list.
|
|
*Allow* refuses everything **not** in it. The second is the one that locks out
|
|
a customer on holiday, so decide which question you are answering before you
|
|
fill in the list. Putting checkout outside the scope is usually right.
|
|
|
|
### Failed sign-ins and two-factor
|
|
|
|
**Security → Login.** The lockout length is shown to the person who is locked
|
|
out, so it is written in plain words. Two-factor is enrolled by each user on
|
|
their own profile; there is deliberately no way to enrol it on somebody else's
|
|
behalf, because a second factor another person set up is not a second factor.
|
|
|
|
### The secrets
|
|
|
|
The AI provider key, the alert webhook address and a vulnerability-data key
|
|
(optional) are kept in a separate, non-autoloaded option, so they are not on
|
|
the row WordPress reads on every request. The screens show a mask rather than
|
|
the value, and submitting the mask unchanged leaves the stored key alone.
|
|
|
|
None of them is required. With no AI key the analyst is simply absent; with no
|
|
webhook nothing is posted anywhere.
|
|
|
|
## How to tell it is working
|
|
|
|
Do not read "no errors". Read these.
|
|
|
|
| Check | Where | What a working site shows |
|
|
|---|---|---|
|
|
| The firewall is actually running | **Overview → This site's protection** | *Firewall: blocking*, and a named state on every row. |
|
|
| It is seeing traffic | **Overview → Requests blocked**, and **Activity** | A non-zero number on any site with visitors. **Zero means two things** — a quiet site and a broken counter — so compare it with **Firewall → Blocks**, which is written by a different path. |
|
|
| Blocking works end to end | **Firewall → Blocks**: add a test address that is not yours, then visit from it | A refusal page, and the block appearing in **Activity**. If the page loads normally, the early file is not installed or a cache is serving around it. |
|
|
| It runs before the rest of WordPress | **Overview → Runs before other plugins** | *yes*. This is the half that loads first, so it is also the half a cache plugin can quietly replace. Switch it on under **Firewall → Rules**. |
|
|
| The scanner has run | **Scanner → Findings** | A *Last scanned* timestamp. A scan that has never run and a scan that found nothing both read "no findings", so look for the time. |
|
|
| The AI analyst is configured | **AI analyst** | A model name it actually fetched from the provider, not just a saved key. A wrong key is stored exactly as happily as a right one. |
|
|
|
|
## If you are locked out
|
|
|
|
Three ways back in, in the order to try them. They are also written on
|
|
**Settings → When something has gone wrong**.
|
|
|
|
1. **The kill switch.** Add this line to `wp-config.php` over FTP, SSH or a
|
|
file manager. It switches off every blocking decision and leaves the screens
|
|
working, so the setting that caused the lockout can be found and changed.
|
|
Nothing in the database can override it.
|
|
|
|
```php
|
|
define( 'NLSEC_DISABLE', true );
|
|
```
|
|
|
|
2. **WP-CLI.** `wp nlsec` is registered as a command and reaches the same
|
|
things from the shell:
|
|
|
|
```
|
|
wp nlsec status
|
|
wp nlsec unblock 203.0.113.9 --allow
|
|
wp nlsec panic # every blocking feature off at once
|
|
wp nlsec 2fa reset username # clear a lost second factor
|
|
wp nlsec verify # do all the rules still compile?
|
|
```
|
|
|
|
3. **Settings → Buttons → Remove every automatic block**, once you are back in.
|