🚪 What is Early Shield and why does it matter?
🎯 What it does
Inspects every HTTP request before WordPress loads. If the address (URL) has a clearly malicious pattern, it rejects it on the spot. It is the fastest and cheapest firewall layer.
⚠️ Why it matters
99% of WordPress attacks are automated: thousands of requests that all look the same. Blocking them before WordPress loads saves CPU, memory and database, keeping resources free for real visitors.
🔍 The 5 checks on every request
Early Shield always looks at the same things, in the same order. If something fails, it cuts. These are five simple but very effective checks against the attacks that make up most of WordPress's malicious traffic:
| What it checks | Why it looks suspicious | Example |
|---|---|---|
| Rare HTTP methods | Browsers use normal methods (GET, POST). Strange methods are only used by attack tools. | TRACE PROPFIND |
| Null bytes | A null character, a small encoding trick used to fool filters and sneak in files that should never be opened. | %00 |
| Overly long URLs | Nobody types an address longer than 2048 characters by hand: it is a sign of an automated scanner or an overflow attempt. | ?a=aaaa… (3000 letters) |
| Exploit patterns | Address fragments that try to escape the site (go up server folders) or open private WordPress files. | ..%2f..%2f wp-config.php /etc/passwd |
| Sensitive files | Database files, backups or passwords that should never be downloadable from the internet. | .sql .env .bak .log |
yourdomain.com/wp-config.php~ and, seconds later, tries variants like yourdomain.com/wp-content/uploads/../../wp-config.php. Without Early Shield, both requests would reach WordPress: the full core, active plugins, and theme would load, and only then would some other layer decide whether to serve the file — burning CPU and memory on every attempt, multiplied by the hundreds of variants a scanner tries within a few minutes. With Early Shield active, the "sensitive files" and "exploit patterns" check catches the pattern directly in the URL, without touching PHP beyond this layer, and cuts it off with a 403 in milliseconds. The scanner keeps trying URLs for several more minutes, but each attempt costs your server a tiny fraction of what it would cost if WordPress had to boot up every time.
⚙️ The 3 modes: Block, Monitor and Off
Early Shield has a switch (enable/disable) and an action dropdown. Here is how each combination works:
🟢 Block (403) — recommended
- Cuts the request with a 403 (forbidden) error. This is the mode you want when your site already works well.
- Important note: it respects the global WAF mode. If your global firewall is in "Monitoring", Early Shield will only log even if "Block" is selected.
🟡 Monitor — log only
- Logs everything it would detect in the Traffic Log, but never blocks. Use it for a few days if you suspect false positives: you'll see what it detects with no risk.
⚪ Disabled
- With the switch off, this layer is not evaluated at all: it neither blocks nor logs. The rest of the firewall (Rate Limiting, Anti-Bot, Anti-Injection…) keeps working normally.
📋 Blocks in the Traffic Log
Every block from this layer appears in the Traffic Log with the label "Early Shield" and an exact reason. These are the reasons you will see:
- Bad HTTP method — a rare HTTP method.
- Null byte in URL — a null character in the address.
- URL too long — an overly long address.
- Exploit pattern — an exploit pattern in the address.
- Sensitive file — an attempt to access a sensitive file.
✅ Short summary
- Start with "Block" if your site already works well and you don't see strange blocks in the Traffic Log.
- If you see legitimate visits blocked (for example, someone with a very long URL), try "Monitor" for a few days: you'll see what it detects without blocking anything.
- "Disabled" only turns off this door: the rest of the firewall keeps protecting you from the inside.
❓ Frequently Asked Questions
Can it block a real visitor?
In practice, very rarely: normal browsers never send rare methods, null bytes, or URLs thousands of characters long. The typical false positive would be someone sharing an auto-generated (very long) URL. If that happens, use "Monitor" for a few days to confirm before deciding.
Does it affect performance?
Quite the opposite: by cutting attacks before WordPress loads, it saves resources (CPU, memory, database). The 5 checks cost milliseconds and only run on the initial request.
Does it require a PRO license?
Yes: Early Shield is a PRO feature. On the FREE plan you'll see this tab marked "PRO" with an upgrade prompt; the rest of the firewall (Rate Limiting, Anti-Injection, Anti-Bot...) works the same on FREE. Check the plan comparison on the pricing page for the full breakdown.
Does it replace Rate Limiting or Anti-Bot?
No. They are independent layers that complement each other: Early Shield filters the "obvious" in the URL, Rate Limiting stops per-IP abuse, and Anti-Bot analyzes client behavior and characteristics. Together they form the recommended defense.