LW Firewall
A firewall that runs inside WordPress rather than in front of it: it rate-limits the endpoints that actually get hammered, blocks the bots worth blocking, bans the addresses that keep coming back, and sets the security headers most sites never get around to.
Blocking
Rate limiting
Per-endpoint limits, so login and XML-RPC can be tighter than the rest of the site.
Bot detection
Recognises the scanners and scrapers worth turning away, and lets the good crawlers through.
IP bans
Addresses that keep tripping the rules get banned automatically, for a period you set.
GeoIP rules
Allow or block by country where that is the right tool for the job.
Hardening
Security headers
CSP, X-Frame-Options and the rest, configured from the admin instead of the vhost.
Log with context
What was blocked, by which rule, from where — enough to tell a false positive from an attack.
WP-CLI
Inspect the log and manage bans from the shell.
It is not a WAF
Requests still reach PHP before this plugin sees them, so it cannot replace a firewall at the edge. It covers the attacks that get past one, and the sites that do not have one at all.