CPGuard WAF: Protecting Websites from SQL Injection, XSS and More

How CPGuard Web Application Firewall blocks web attacks at the server level — more effective than relying on WordPress plugins alone.

What is WAF and How Does CPGuard WAF Work?

A Web Application Firewall inspects and filters every HTTP/HTTPS request before it reaches PHP or the website database. CPGuard WAF operates at the server level — providing protection even when application code has vulnerabilities — using OWASP Top 10-aligned rules, the international standard for critical web application security risks.

• Inspects every request before reaching PHP and the database
• Protects sites even when their own code has vulnerabilities
• OWASP Top 10-aligned rule set — international standard
• Rules updated automatically as new threats emerge
• Works alongside CPGuard Malware Scanner and Firewall

Blocking SQL Injection

SQL Injection inserts SQL commands into web inputs to directly extract or modify database content — one of the most common and damaging web attacks. CPGuard WAF detects SQL Injection patterns and blocks requests before they reach the database, protecting even legacy PHP sites that do not sanitise user input.

• Detects patterns like OR 1=1, UNION SELECT, DROP TABLE
• Blocks Blind SQL Injection, which is harder to detect
• Protects WordPress and plugins with SQL vulnerabilities
• Logs every attack attempt for forensic review

Blocking Cross-Site Scripting (XSS)

XSS embeds malicious scripts in web pages through unsanitised inputs. When other users load the affected page, the script executes in their browser — enabling session cookie theft, redirects to malicious sites, or phishing overlays. CPGuard WAF detects Reflected, Stored, and DOM-based XSS before scripts are stored or executed.

• Detects <script> tags and event handlers in user input
• Blocks JavaScript protocol smuggled in URLs or attributes
• Prevents Stored XSS before it is written to the database
• Whitelist mode available to reduce false positives

Blocking RFI and LFI

Remote File Inclusion (RFI) tricks PHP into loading external files; Local File Inclusion (LFI) accesses local system files that should be inaccessible — such as /etc/passwd or application configuration files. CPGuard WAF detects path traversal patterns and external URL parameters, blocking them before PHP processes the request.

• Detects ../ path traversal in URL parameters
• Blocks http:// and ftp:// in PHP include paths
• Prevents reading /etc/passwd or wp-config.php via LFI
• Stops shell uploads via RFI

Brute Force Protection

Beyond WAF rules, CPGuard includes Brute Force Protection that automatically blocks IP addresses exceeding a configurable failed-login threshold. Coverage extends to WordPress wp-login.php, DirectAdmin, FTP, SSH, and email login — all common brute-force targets.

• Counts failed logins and automatically blocks offending IPs
• Covers WordPress, DirectAdmin, FTP, SSH, and email
• Configurable threshold and block duration
• Trusted IP whitelisting to prevent false positives
• Admin alerts when brute-force attacks are detected

Automatic Rule Updates

Web threats evolve continuously — rules that are not updated quickly become ineffective against new attacks. CPGuard automatically pulls rule updates from a central database, keeping WAF coverage current without requiring server administrator intervention.

• Automatic rule updates from central database
• Covers new vulnerabilities in WordPress, plugins, and PHP
• No manual update work required from admins
• Rollback capability if new rules cause excessive false positives

Whitelist and Exception Configuration

WAF rules can occasionally block legitimate requests — for example, a WooCommerce checkout with special characters, or an API endpoint accepting JSON that resembles an attack payload. CPGuard supports whitelist rules for specific URLs or parameters that should bypass WAF inspection, balancing security with application functionality.

• Whitelist specific URLs (e.g. /api/endpoint)
• Whitelist specific parameters on defined paths
• IP whitelisting for trusted sources
• Log-only mode to test new rules before enforcing them

Choose Hosting with Server-Level WAF

Server-level WAF differs from WordPress security plugins: it operates before PHP loads, stopping attacks faster and without adding PHP processing overhead. AsiaGB.com provides hosting and VPS with server-level security, SSD storage, DirectAdmin, 24-hour Thai support, and 99% uptime.

• Server-level WAF stops attacks before PHP even loads
• No PHP resource overhead unlike WordPress plugins
• Protects every app on the server simultaneously
• Ask your provider whether server-level WAF is included