We’re thrilled to announce EarlyDog, our fully managed hosting on Google Cloud servers EarlyDog: managed hosting on Google Cloud

Blog
Follow ServerPilot on Twitter

HeatShield WordPress Firewall Available on All Servers

September 30, 2020

We're excited to announce the launch of HeatShield's WordPress Web Application Firewall. A Web Application Firewall (WAF) looks at the content of HTTP requests and blocks requests that are malicious.

HeatShield is the first WordPress security plugin to offer a WAF built on the industry-standard ModSecurity WAF engine. HeatShield also offers free WordPress brute force login protection.

HeatShield's WAF protects WordPress from XSS attacks, SQL injection attacks, command injection attacks, and more using ModSecurity's advanced WAF engine and the OWASP ModSecurity Core Rule Set (CRS).

HeatShield is made by us, the same people who make ServerPilot.

Features and Pricing

HeatShield's WordPress security plugin offers a free plan and a paid plan:

  • Free: WordPress brute force login protection
  • $10/month: Web Application Firewall built on ModSecurity

HeatShield's Web Application Firewall includes the OWASP Core Rule Set, the highly trusted rule set used by services such as CloudFlare's WAF.

For more details, see HeatShield's pricing.

How the HeatShield Plugin Works

The HeatShield agent is already installed on servers managed by ServerPilot.

HeatShield is able to offer an enterprise-grade WAF through a WordPress plugin by having the plugin communicate with an agent process running on your server.

This type of enterprise firewall is not possible to implement directly in a WordPress plugin, which is why HeatShield is the first to bring ModSecurity to a WordPress plugin. HeatShield's advanced architecture allows you to even further benefit from your decision to use cloud servers for hosting WordPress.

Installing the WordPress Plugin

To install the HeatShield plugin on a new app you're creating in ServerPilot, select the HeatShield checkbox in ServerPilot's WordPress installer. Next, log in to your WordPress dashboard, go to plugins, and click on HeatShield. From there, follow the instructions to activate the plugin.

To install the HeatShield plugin on an existing app, log in to HeatShield, click on Install WordPress Plugin, and follow the provided instructions.

SSH Brute Force Login Protection

HeatShield also offers free SSH/SFTP brute force protection. In order to use HeatShield's SSH brute force protection, create your HeatShield account and follow the instructions in HeatShield to enable SSH brute force protection on your server.

Additionally, HeatShield offers a paid service for customizing IP packet filter (iptables) rules on your server. Most ServerPilot users do not need to customize their IP packet filter rules. If you aren't sure why you'd want to do this, don't worry! Your server is secure without this added complexity.

An IP packet filter is sometimes called a network firewall. If you're curious to learn more, see HeatShield's article on the difference between a WAF and a network firewall.