wirewall .
NEW IN 1.14 Verified Apple Private Relay

Your site.
Your rules.

A configurable security layer for ProcessWire.
Control traffic, keep trusted visitors moving, and understand every decision.

Get started Explore the source
WireWall / Policy preview Illustrative scenarios
01 / INCOMING REQUEST

A regular visitor

A browser request that passes the configured policy.

Browser Public page
POLICY ENGINE

Checks in order.
A clear decision.

TrustEarly protectionIdentityNetworkGeography
02 / POLICY RESULT Allowed

Welcome through.

No matching block or challenge. Continue to the ProcessWire page.

Your ProcessWire site Application permissions still apply
Example only. Decisions depend on your configuration and the request.
1.14.0 Current version IPv4 / IPv6 CIDR support Local-first IP intelligence 100% Open source

AT HOME IN THE PROCESSWIRE ECOSYSTEM

LQRS E-commerce
SKFO Education
ProcessWire Community
Your Site Next

ONE LAYER. FOUR WAYS TO TAKE CONTROL.

Protection you can
actually reason about.

Geography, identity, automation and incident response — connected by an explicit policy, native to your CMS.

01 / PRECISE TRAFFIC POLICY

Let the right traffic in.

Define geographic and network policies while preserving carefully scoped access for verified visitors.

Choose the audience. Keep the exceptions precise.

Explore all 7 controls
City-Level Blocking

Block specific cities worldwide (Philadelphia, Beijing, Tokyo, Moscow) with MaxMind GeoLite2-City database for precise targeting.

Region/Subdivision Blocking

Block entire states, provinces, or oblasts like Pennsylvania, California, Krasnodar, or New South Wales.

VPN/Proxy/Tor Detection

Local-first MaxMind/ASN intelligence, optional IP2Proxy LITE, and cached opt-in HTTP enrichment. Separate policies for privacy relays, VPNs, proxies and Tor.

ASN/Datacenter Blocking

Block entire networks and datacenters by ASN (AWS, Google Cloud, DigitalOcean, Azure, hosting providers).

Exception System

Scoped known-bot and browser exceptions. Supported crawlers use DNS verification; supported monitors use official IP feeds. Only the explicit IP whitelist is a full bypass.

Verified Apple Private Relay

New in 1.14.0: optional official IPv4/IPv6 feed verification. Off by default; exempts automatic proxy/datacenter classification only. Other protections still apply.

Verified Crawlers & Monitors

DNS verification for configured Google/Bing crawlers and Lighthouse; official IP feeds for supported synthetic monitors. Exceptions remain scoped.

Traffic policy Example configuration
Country → City → Subdivision Ordered checks
Verified identities Scoped exceptions

City and subdivision rules require GeoLite2-City. Earlier blocking decisions stop evaluation.

02 / BOT & SCANNER PROTECTION

Put a stop to noisy automation.

Combine request limits, browser checks and bot policies before public requests reach your pages.

A quieter front door.

Explore all 5 controls
Fake Browser Detection

Advanced User-Agent analysis to detect spoofed browsers and bot masquerading as legitimate traffic.

Headless Browser Detection

Detect Puppeteer, Playwright, Selenium, and PhantomJS automated browsers for scraper protection.

Rate Limiting

Per-IP limits in a fixed 60-second window, with a configurable temporary ban duration. Complements upstream protection and application-level abuse controls.

AI Bot Blocking

Block GPTBot, ClaudeBot, GrokBot, Perplexity, and Google-Extended AI training bots automatically.

JavaScript Challenge

Anti-bot challenge page for suspicious requests. Detect and block automated scripts.

Request inspection Illustrative trace
request GET /scanner-probe
✓
Trusted access No matching bypass
×
URL / User-Agent trigger Configured scanner pattern matched
Block
·
Remaining checks Evaluation stops after the block
Before public page execution

03 / INCIDENT OPERATIONS

Understand. Adjust. Recover.

Follow the decision trace, preview a policy and respond to an incident from the native ProcessWire dashboard.

Decisions you can inspect. Changes you can review.

Explore all 6 controls
Emergency TTL Rules

Temporarily block IPs, ASNs, countries or datacenter traffic with automatic expiry. Dashboard actions are permission- and CSRF-protected.

Profiles & Snapshots

Preview profile changes, compare settings, restore snapshots and import/export validated rule JSON. Review changes before applying them.

Rule Simulator

Explore allow, block or challenge decisions without sending a real request. Inspect decision traces and review possible false positives.

Private Traffic Reports

Daily JSONL history outside the document root. Download protected reports, last-24-hour exports, date-range ZIPs and redacted incident bundles.

Retention & Alerts

Gzip rotation, retention and disk caps, blocked-traffic spike alerts, notification cooldowns, and configurable email/webhook delivery.

Optional Squad Review

Send redacted incident context to an installed Squad module. Review recommendations in the dashboard; they are never applied automatically.

Incident workspace Illustrative workflow
REVIEW → PREVIEW → RESPOND

Make the next move clear.

01 Inspect

Decision trace
False-positive review

02 Preview

Rule simulator
Snapshot comparison

03 Respond

TTL rules
Protected reports

Optional Squad recommendations Review-only

04 / LOCAL-FIRST ARCHITECTURE

Your server. Your security layer.

Keep intelligence and reporting close to your application, with optional enrichment and explicit integration boundaries.

Local by design. Connected where you choose.

Explore all 3 controls
File-Based Cache

File-based caches for IP intelligence, rate limits and temporary bans. Monitor cache usage in the dashboard; performance depends on your host and traffic.

Cache Management

Built-in UI to view statistics and manage cache. Clear by type or reset everything with one click.

Module-Owned API Routes

New in 1.13.0: namespaced route registration with validated path-prefix matching. Each integration still owns authentication and abuse controls.

Inside your ProcessWire site Self-hosted
WireWall
├─ IP intelligence Local-first
├─ Cache & temporary bans File-based
├─ Traffic history Private directory
└─ Module integrations Explicit routes

Optional enrichment is opt-in. Each API route keeps responsibility for authentication and abuse controls.

HOW IT WORKS

One request.
Five stages. A clear decision.

Follow the execution order. Expand a stage to inspect every check.

01 Trusted access Admin, integrations & trusted IPs

CHECKS IN ORDER

0 Admin Area
The configured ProcessWire admin path bypasses the public traffic firewall.
0.5 Trusted API / AJAX Routes
Explicit module-owned API routes and configured trusted module/AJAX exceptions. Routes must enforce their own security.
0.7 Logged-In Users
Authenticated ProcessWire users bypass public traffic checks. Application permissions remain separate.
1 IP Whitelist
Explicit trusted IPs and CIDR ranges bypass the remaining firewall checks.
02 Early protection Bans, triggers & request limits

CHECKS IN ORDER

1.5 Emergency Rules
Temporary IP, ASN, country or datacenter rules; automatic TTL expiry.
2 Active Temporary Ban
Stop requests from currently banned IP addresses.
2.5 URL / User-Agent Triggers
Apply configured strike rules or immediate scanner-trigger bans.
3 Rate Limiting
Fixed 60-second request window; separate configurable ban duration.
4 IP Blacklist
Evaluate explicit IP and CIDR blacklist rules.
03 Identity & challenge Verified clients & browser checks

CHECKS IN ORDER

4.5 Scoped Identity Exceptions
Verify supported crawlers/monitors; classify known-bot and compatibility exceptions. No blanket ASN bypass.
5 JavaScript Challenge
Apply the configured challenge, subject to scoped compatibility exceptions.
04 Network policy Proxy, datacenter & ASN rules

CHECKS IN ORDER

6 Proxy / Privacy Policy
Local-first risk classes and optional sensitive-route escalation. Verified Apple Relay can skip automatic proxy/datacenter classification when enabled.
7–8 Datacenter & ASN Rules
Evaluate datacenter policy and explicit ASN blocks. Apple Relay does not bypass explicit ASN rules.
05 Content & geography Global, country, city & region rules

CHECKS IN ORDER

9 Global Rules
Bot heuristics and explicit path, User-Agent and referer rules, with scoped exceptions.
10 Country Blocking
Country blacklist/whitelist policy runs before city and region policy.
10.5 City Blocking
Evaluate configured city rules when GeoLite2-City is available.
10.6 Region/Subdivision Blocking
Evaluate configured subdivision rules when GeoLite2-City is available.
11 Country-Specific Rules
Apply remaining country-specific rules. Requests passing all applicable checks are allowed.

All applicable checks passed? Request allowed. A trusted-access match exits early. Otherwise, a blocking decision stops evaluation.

Explore sample traffic logs

Security Traffic Logs

Animated, illustrative records. Documentation-only IP addresses; no live visitor data or measured blocking-rate claim.

Status Location IP Network Reason

CONFIGURE FOR YOUR AUDIENCE

A starting point.
Not a universal policy.

Illustrative configurations — adapt to your audience and test on staging before enabling.

Attack Protection

Attack Protection

Illustrative restrictive profile

Countries Blocked RU, CN, KP, IR, BY
VPN/Proxy Detection Enabled
Datacenter Blocking Enabled
AI Bots Blocked
Rate Limiting 10 req/min
E-commerce Security

E-commerce Security

Protect online stores

Selected Countries Blacklist mode
VPN/Proxy Detection Enabled
Rate Limiting 20 req/min
Maximum Security

Maximum Security

All protection layers enabled

Country Blocking
City Blocking
Region Blocking
VPN/Proxy/Tor
Datacenter Block
ASN Blocking
AI Bot Blocking
Fake Browser Detect
Rate Limit: 10/min
Explore the configuration interface

WireWall Configuration

Admin Panel
Enable WireWall
Activate security protection
Block Cities
Philadelphia Beijing Moscow + Add city
Block Regions
Pennsylvania Krasnodar + Add region
VPN/Proxy/Tor
Enabled
Rate Limit
10 req/min
Your site is now protected by WireWall

Illustrative interface and settings, not your live configuration.

FROM THE ORIGINAL REPOSITORY

Built in the open.
Getting more capable.

Full changelog ↗
1.14.0

Verified Apple Private Relay

Default-off official Apple IPv4/IPv6 feed verification. Only automatic proxy/datacenter classification is exempt; explicit blocks, rate limits, geography, challenges and authentication remain. Prewarm the private index before enabling.

October 20, 2026

Read changelog →
1.13.0

Module-Owned API Integrations

Validated, namespaced route registration lets installed modules manage their own exceptions without replacing administrator paths. Owning routes remain responsible for authentication, authorization and abuse controls.

October 19, 2026

Read changelog →
1.12.0

Incident Operations & IP Intelligence

Emergency TTL rules, profiles, snapshots, simulation, false-positive review, per-class policies, local IP2Proxy, retention and alerts. Optional Squad recommendations remain review-only.

July 30, 2026

Read changelog →

GET UP AND RUNNING

A native module.
A deliberate setup.

ProcessWire 3.0.200+ · PHP 8.1+ · Free and open source

01

Download & Install

Clone from GitHub or download ZIP and place in your ProcessWire modules directory.

cd site/modules/
git clone https://github.com/mxmsmnv/WireWall.git
02

Activate Module

Go to Modules → Refresh. Install both WireWall and WireWall Dashboard, then configure the firewall.

Admin → Modules → Install
Enable WireWall
Configure settings
03

Verify & Monitor

Test on staging, review possible false positives, and check required API routes before tightening policy. Open the native dashboard to investigate traffic.

Setup → WireWall
View blocked requests
Monitor traffic patterns
Read the complete installation guide ↗
What’s built in. What’s optional.

Choose the dependencies your policies need.

Capability WireWall Requirement
Geographic rules Country, city & subdivision GeoLite2-City for city/region rules
Bot & scanner controls Built in Configure patterns and trigger policy
Proxy / privacy classes Local-first policies Optional IP2Proxy SDK + database
Apple Private Relay Optional · off by default PHP cURL, private cache, verified official feed
Incident operations TTL rules, profiles & snapshots Authorized WireWall dashboard access
Traffic history & exports Private JSONL / ZIP reports Writable private directory; retention policy
AI incident review Optional Squad integration Installed Squad module
Module-owned API routes Namespaced integrations Route-level authentication & abuse controls

Scroll horizontally on smaller screens.

A FEW MORE THINGS

Good questions.
Clear answers.

Need a hand? ↗
Do I need MaxMind databases or can I use the HTTP fallback?
WireWall uses a local MaxMind/ASN baseline. Optional HTTP IP enrichment is disabled by default in local-only mode. City and subdivision rules require GeoLite2-City; optional IP2Proxy LITE requires its SDK and local database. Review the installation guide for lookup fallbacks and network requirements.
What is fake browser detection and why is it important?
Fake-browser detection uses User-Agent and request-header heuristics to identify suspicious or automated clients. These signals can produce false positives and are not proof of malicious intent. Review decisions and use narrowly scoped compatibility rules where needed.
Will blocking VPN/Proxy users affect my legitimate customers?
Yes, blanket proxy blocking can affect legitimate users. Use separate allow/challenge/block policies for privacy relays, consumer VPNs, datacenter proxies, Tor and other proxy classes. Version 1.14.0 adds a default-off verified Apple Private Relay option using the official feed; other firewall checks still apply. There is no required multi-provider voting rule.
How do I prevent accidentally blocking myself or my team?
The configured ProcessWire admin path and logged-in ProcessWire users bypass public firewall checks. The explicit IP whitelist is a full bypass; known-bot ASN and User-Agent exceptions are scoped. Test on staging and keep an administrative recovery path before enabling restrictive rules.
Can I use city blocking and region blocking together?
Yes, but order matters: country rules run before city and subdivision rules. An earlier blocking decision stops evaluation, so a later city rule cannot rescue a country-blocked visitor. City and subdivision control both require GeoLite2-City. Use the simulator to inspect combined policies.
What happens when the file cache grows to millions of entries?
Cache capacity and lookup performance depend on filesystem, host resources and traffic. The dashboard exposes cache usage and per-type management. Configure retention and disk caps for traffic history; the website does not claim a verified million-IP benchmark or zero performance impact.
How often should I update the MaxMind databases?
Keep your MaxMind databases current according to your operational requirements and provider guidance. Place the .mmdb files under /site/assets/WireWall/geoip/, not in the module source directory. Install the GeoIP PHP dependency as described in INSTALL.md and verify database status in module configuration.
How do I whitelist search engines and legitimate bots?
Configure known-bot exceptions carefully. Supported Google/Bing crawlers and Lighthouse use DNS identity verification; supported synthetic monitors use official IP feeds. These are scoped exceptions, not full firewall bypasses. Bans, triggers, rate limits, explicit blocks and geographic restrictions still apply.
Is WireWall compatible with other security modules?
WireWall hooks before ProcessPageView::execute to protect public page requests. It complements application authentication, authorization and server security. Explicit API exceptions require route-level authentication and abuse controls. Test other security modules and integrations on staging; universal compatibility is not guaranteed.

YOUR NEXT REQUEST STARTS HERE

Give your site
a clearer front door.

Install WireWall → Explore on GitHub ↗