7G Firewall for WordPress – Server-Level Protection with WP Ghost
March 3, 2023
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Activate the 7G Firewall in WP Ghost for server-level protection against SQL injection, script injection, XSS, and malicious bot traffic. The 7G ruleset blocks attacks before WordPress, PHP, or any plugin code executes.
What is the 7G Firewall
The 7G Firewall is a set of server-level security rules created by Jeff Starr of Perishable Press. It is part of his G-series firewall rulesets (5G, 6G, 7G, 8G). WP Ghost includes the 7G ruleset, so you do not need to manually edit any configuration files.
The 7G ruleset blocks malicious requests, bad bots, automated attacks, spam, SQL injection, and script injection attempts through lightweight pattern filtering. WP Ghost loads the rules in one of two places, set under Firewall Location: On website initialization, the default and recommended option, or In .htaccess file on Apache and LiteSpeed, where the rules run before PHP starts. Nginx doesn’t read .htaccess. Either way, blocked requests never reach your pages, plugins or database.
What the 7G Firewall blocks
The 7G ruleset filters incoming HTTP requests and blocks several categories of attacks as part of your hack prevention strategy:
SQL injection. Malicious queries that try to read, modify, or delete your database content. A successful one can give the attacker direct database access. The 7G ruleset blocks SQL injection patterns in URL parameters, POST data, and query strings.
Script injection and XSS. Attempts to inject JavaScript, PHP, or other executable code through URL parameters, form fields, or headers. These attacks try to execute code in visitors’ browsers (XSS) or on your server (remote code execution).
Directory traversal. Requests that use ../ sequences to navigate outside the web root and access sensitive server files like /etc/passwd or wp-config.php.
File inclusion exploits. Attempts to include remote or local files through URL parameters, which can lead to code execution or information disclosure.
Bad bots and automated scanners. Requests from known malicious user agents, vulnerability scanners, and automated attack tools.
Malicious query strings. Unusual HTTP methods, excessively long query strings, and request patterns that match known exploit toolkits.
7G vs. 8G – Which should you use
WP Ghost offers five firewall levels: Minimal, Medium, 7G, 8G and 2026 Ghost Firewall. The 2026 Ghost Firewall is WP Ghost’s own ruleset, the recommended level and the default on new installs. The 8G Firewall includes all 7G protections plus updated patterns for modern attack techniques and fewer false positives. Use 7G in these specific situations:
When 8G causes a false positive. If a specific plugin feature, form submission, or admin action stops working after enabling 8G, the 8G-specific rules may be triggering on a legitimate request. Switch to 7G to confirm the issue is 8G-specific. If 7G works without the false positive, you can stay on 7G or whitelist the affected path and switch back to 8G.
When your server configuration has compatibility issues with 8G. Some older server configurations or custom hosting environments may not support all 8G directives. If 8G returns 500 errors or blank pages, 7G is the immediate fallback.
When you want the older, settled ruleset. 7G came before 8G and its rules change less often. Pick 7G if stability matters more to you than the newest attack patterns.
| Feature | 7G Firewall | 8G Firewall |
|---|---|---|
| SQL injection blocking | Yes | Yes, with updated patterns |
| Script injection and XSS | Yes | Yes, with updated patterns |
| Directory traversal | Yes | Yes |
| File inclusion exploits | Yes | Yes |
| Bad bot blocking | Yes | Yes, with expanded list |
| False positive rate | Low | Lower (refined rules) |
| Modern attack patterns | Older ruleset | Newer ruleset |
| Best for | Fallback when 8G conflicts | Fallback when the 2026 Ghost Firewall conflicts |
How to activate the 7G Firewall in WP Ghost
1. Go to WP Ghost > Change Paths > Level of Security. Select Safe Mode (Lite Mode in WP Ghost free) or Ghost Mode (Premium) and save. The firewall requires an active security level.
2. Go to WP Ghost > Firewall.
3. Switch on Firewall Against Script Injection.
4. Select 7G Firewall from the Firewall Strength list.
5. Under Firewall Location, keep On website initialization (recommended) or choose In .htaccess file on Apache or LiteSpeed, where the rules run before PHP loads. On Nginx, the firewall loads on website initialization.
6. Click Save.
After activating, test your site thoroughly. Browse your key pages, submit any forms, test WooCommerce checkout (if applicable), and verify admin functions work correctly. If any legitimate functionality breaks, try switching to the Medium or Minimal firewall level.
How the firewall fits into your security stack
The firewall is one layer in a complete hack prevention strategy. Path security makes your WordPress installation invisible to bots. The firewall catches whatever gets through – requests that are not targeting WordPress-specific paths but still contain malicious payloads. Together, they cover both the reconnaissance and exploitation phases of an attack.
For the complete firewall guide including Automate IP Blocking (Premium), header removal, theme detector blocking, and AI crawler blocking, see the Firewall Security tutorial. For the newer 8G ruleset, see the 8G Firewall Protection guide.
The firewall also works alongside other security plugins. WP Ghost’s firewall checks each request on its own, while a scan-based security plugin works inside PHP. We cover two of them in WP Ghost with a popular firewall plugin and WP Ghost with a popular hardening plugin. They run as separate filters and don’t block each other.
Frequently asked questions
Should I use 7G or 8G?
Start with the 2026 Ghost Firewall, the recommended level and the default on new installs. Between the two older levels, 8G has broader coverage and fewer false positives than 7G. Only switch to 7G if 8G causes a specific compatibility issue with a plugin or server configuration. 7G has been deployed the longest, but it lacks the pattern updates that 8G includes.
Does the 7G Firewall affect performance?
Blocked requests are rejected early, so they use little server time, and legitimate traffic sees no noticeable overhead. With the rules in .htaccess, a blocked request is rejected before PHP starts.
Is the 7G Firewall included in the free version of WP Ghost?
Yes. The 7G, 8G and 2026 Ghost Firewall levels are all included in the free version of WP Ghost.
Can I use this alongside another security plugin?
Yes. WP Ghost’s firewall and a scan-based security plugin run as separate filters on each request and don’t block each other.
Does the firewall affect SEO?
No. WP Ghost automatically whitelists major search engine crawlers (Googlebot, Bingbot, Yandex) when the 7G Firewall is active. Legitimate crawlers access and index your site normally.
Does this work with WooCommerce?
Yes. WooCommerce checkout, cart, AJAX, and payment processing work normally with the 7G Firewall enabled. If a specific WooCommerce action triggers a false positive, whitelist the affected path in WP Ghost > Firewall > Whitelist Paths.
Does WP Ghost modify WordPress core files?
No. The 7G rules are placed in .htaccess (Apache) or loaded through WordPress hooks (Nginx/LiteSpeed). No core files are modified. Disabling the firewall removes all rules instantly.
