by
Oliver Campion
1 (0 reviews)
Deny All Firewall
Stop unwanted requests before WordPress loads. Deny All Firewall uses .htaccess to allow genuine content and refuse everything else.
Deny All Firewall ranks #20,888 among WordPress.org plugins with 50+ active installations, is #1,227 of 5,058 in the Security category, a 1/5 rating from 0 reviews, and was last updated Oct 7, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v2.0.4
Current Version v2.0.4
Updated 1 month ago
Last Update on 07 Oct, 2026
Refreshed 1 week ago
Last Refreshed on
#1,227 of 5,058 in Security
Top 50% by installs
Downloads +52.5% this week
Rank
#20,888
—
No change
Active Installs
50+
+42.9%
KW Avg Position
103.7
1 worse
Downloads
9.6K
+4 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(0 reviews)
Next Milestone 60
50+
60+
1,939
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 6 more installs to reach 60+
Rank Changes
Current
#20,888
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
0 reviews
Overall
20%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 2.0.4
- Last Updated
- Oct 07, 2026
- Requires WP
- 5.0+
- Tested Up To
- 7.1
- PHP Version
- 7.0 or higher
- Author
- Oliver Campion
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about Deny All Firewall
No. Deny All Firewall reduces the public attack surface and unnecessary processing. Continue to update WordPress, themes and plugins, use strong authentication, maintain backups and follow normal server-security practices.
Attack signatures can identify known bad input, but they must continually account for new variations. Deny All Firewall begins with the smaller question: which public requests does this particular website genuinely need? Requests outside that answer can be refused before WordPress processes them. This complements other security layers rather than making them unnecessary.
Yes. Strict rules can expose unusual requirements in forms, ecommerce extensions, webhooks, membership systems and third-party integrations. The plugin preserves normal WordPress functionality and known public content, but it cannot predict every custom implementation. Test the site after enabling the firewall and use Blocked Request Troubleshooting to investigate genuine requests before allowing them.
No. The configured WordPress REST API path and rest_route requests remain available. Write methods such as PUT, PATCH and DELETE are refused elsewhere because ordinary public WordPress pages do not normally need them.
No. The plugin generates a static robots.txt file from WordPress's filtered output so crawlers do not need to load WordPress repeatedly. The standard WordPress sitemap remains allowed. If the website already has a physical robots.txt file that Deny All Firewall did not create, it is left unchanged. Sites that need WordPress to generate different robots.txt contents for different hostnames can disable the physical file with the daf_enable_static_robots_txt filter: add_filter('daf_enable_static_robots_txt', '__return_false'); Refresh the firewall rules once after adding or removing this filter. When disabled, Deny All Firewall removes only a robots.txt file that it previously generated and leaves other physical files untouched.
The temporary log records information needed to identify a refused request, including the requested address, time and originating IP address. Logs may therefore contain personal data under some privacy laws. Logging is disabled automatically when the firewall is disabled. The log is limited to approximately 10 MB and is deleted when troubleshooting is turned off.
The plugin's lightweight blocked page recognises a deliberately small set of suspected malicious requests for items such as environment files, repository internals, cloud credentials, specifically named attack scripts and direct PHP requests within internal WordPress core directories. Genuine directly accessible WordPress maintenance and script-delivery endpoints are excluded. It records the time, visitor IP address, HTTP method and matched path without loading WordPress. Automated malicious probing is common on public websites. Every request shown in the Dashboard panel was blocked before WordPress loaded. The records show attempted probing, not a successful compromise, and no action is normally required. The Dashboard panel shows the ten busiest originating IP addresses and the paths they requested during the rolling last 60 minutes. These always-on records are kept in hourly files under wp-content/deny-all-firewall, which is protected from public access. Each hourly file stops growing at 10 MiB. Only the current and immediately preceding UTC-hour files are retained, and the runtime directory is removed when the plugin is properly deactivated.
Exact Content Protection may need a refreshed rule for newly published content. The plugin monitors relevant content changes and displays an administrator notice when its rules should be refreshed. Larger sites use broader automatic matching and do not require an individual rule for every public item.
Use your hosting control panel, FTP or file manager to edit the site's .htaccess file. Remove only the section between: # BEGIN Deny All Firewall and: # END Deny All Firewall
Not currently. The generated rules require Apache with mod_rewrite and .htaccess support.
