Firewall: rate limiting, request rules, fake bots and exceptions

The Firewall group (formerly Request blocking) under MuRu Guard → Settings → Site Protection includes opt-in rules that stop floods, scripted probing and impostor crawlers, plus a list of page paths the request filters should leave alone. They are Pro features; rate limiting and the method and User-Agent rules need the Shield plugin 2.1.0 or newer, and the bot and exception rules need Shield 2.2.0 or newer.

Rate limiting

Blocks an IP that sends more requests than you allow inside a time window.

• Max requests - how many requests one IP may make per window (default 120).
• Per seconds - the window length (default 60).
• Block for (minutes) - how long the IP is refused once it goes over (default 10).

The backend (/administrator) is never rate limited, because the admin interface legitimately sends bursts of requests. IPs on your Allow list bypass every Shield rule, including this one.

Restrict HTTP methods

Refuses TRACE, TRACK, CONNECT and unknown request methods, which are used for probing. GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS - everything Joomla and its web services use - stay allowed.

Block requests with no User-Agent

Real browsers and search engines always identify themselves; most attack scripts do not. Turn this on only if none of your uptime monitors or integrations send requests without a User-Agent.

Block impostor search-engine bots

Scrapers and scanners often claim to be Googlebot or Bingbot to get past allow rules. When a request says it is Googlebot, Bingbot, Yandex, Baidu or Applebot, Guard looks up the visitor's reverse DNS, confirms it belongs to that search engine and resolves back to the same IP, and refuses the request when it does not. Real crawlers are never blocked, and a failed DNS lookup lets the request through. This is different from Block known scanner/bot user agents, which blocks attack tools by name.

Firewall exceptions

Some pages legitimately post code or SQL-like text, which the pattern, virtual-patch and WAF filters can mistake for an attack. List the page path (one per line, for example /index.php/contact-form) and requests to it skip those filters. IP blocks, brute-force, country and rate-limit checks still apply, entries shorter than three characters are ignored, and the scan's Ignored paths setting is separate.

Where to see what was blocked

Every refusal appears in Settings → Threat Monitor → Recent events with its own rule name (rate_limit_exceeded, http_method_blocked, empty_user_agent, fake_search_bot). If anything goes wrong inside the rules, the request is allowed through - the firewall never takes the site down.

Use Test a Request and the Threat Monitor for a few days before tightening the limits on a busy site.

These rules are inert without an active Pro license, and Shield settings must be saved with Protection Mode switched on.