Firewall: rate limiting, HTTP-method and User-Agent rules

The Firewall group (formerly Request blocking) under MuRu Guard → Settings → Site Protection now includes three opt-in rules that stop floods and scripted probing. They are Pro features and need the Shield plugin 2.1.0 or newer.

Rate limiting

Blocks an IP that sends more requests than you allow inside a time window.

• Max requests - how many requests one IP may make per window (default 120).
• Per seconds - the window length (default 60).
• Block for (minutes) - how long the IP is refused once it goes over (default 10).

The backend (/administrator) is never rate limited, because the admin interface legitimately sends bursts of requests. IPs on your Allow list bypass every Shield rule, including this one.

Restrict HTTP methods

Refuses TRACE, TRACK, CONNECT and unknown request methods, which are used for probing. GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS - everything Joomla and its web services use - stay allowed.

Block requests with no User-Agent

Real browsers and search engines always identify themselves; most attack scripts do not. Turn this on only if none of your uptime monitors or integrations send requests without a User-Agent.

Where to see what was blocked

Every refusal is written to the Activity log sub-tab with its own rule name (rate_limit_exceeded, http_method_blocked, empty_user_agent). If anything goes wrong inside the rules, the request is allowed through - the firewall never takes the site down.

Use Test a Request and your Activity log for a few days before tightening the limits on a busy site.

These rules are inert without an active Pro license, and Shield settings must be saved with Protection Mode switched on.