Configure the web application firewall (WAF)

The WAF blocks common attacks (SQL injection, XSS, bad bots) before they reach your site.

Steps

1. Go to Websites → [site] → Firewall.
2. Set the mode / paranoia level — higher levels block more but can occasionally flag legitimate requests.
3. Add IP or URL bypass rules for trusted sources or paths that get false-positived.
4. Save. Monitor for a while after raising the level.

Troubleshooting

• Legitimate action blocked (e.g. saving a long post) — add the URL or your IP to the bypass list, or lower the paranoia level.
• Still seeing attacks — combine the WAF with strong passwords, updates, and the security tools on the Security page.

Related: Run a malware scan and clean an infection · Manage plugins, themes & WordPress core