Building a web application firewall sounds straightforward. You analyze incoming requests, identify patterns that match known attack signatures, and block the ones that look malicious. Clean, logical, finite.
Then you try to build one that works with WordPress — and specifically with WooCommerce — and you discover that “clean, logical, and finite” are exactly the wrong words for what you’re dealing with.
The Problem With Generic WAF Rules
Most web application firewalls were designed for generic web applications, then retrofitted for WordPress. The issue is that WordPress generates traffic that looks suspicious to a generic WAF — because WordPress does things a generic web app doesn’t do.
Consider SQL injection detection. A WAF looking for SQL injection patterns will flag queries that contain SELECT, WHERE, JOIN, or UNION keywords in request parameters. Legitimate WordPress admin operations — search queries, post meta lookups, WooCommerce order filters — can trigger these exact patterns in their URL parameters.
Or consider XSS detection. WordPress content editors legitimately submit HTML through the post editor. A firewall that blocks HTML in POST request bodies will block every Gutenberg save operation. You’ve just made it impossible to write a blog post.
Generic WAF rules applied to WordPress produce one of two outcomes: false positives that break your site, or false negatives that let attacks through. Often both.
How We Built It Differently
The SwissWPSuite WAF was built WordPress-first. We mapped the full surface area of legitimate WordPress traffic — core, WooCommerce, REST API, AJAX handlers, the block editor, comment submissions, login flows — before we wrote a single detection rule.
That mapping became our baseline. Requests that fall within expected patterns for a given endpoint pass through. Requests that deviate from those patterns in ways that match attack signatures get flagged or blocked, depending on their threat score.
The key innovation was context awareness. The WAF doesn’t apply the same rules to every request. It applies different logic to:
- Login endpoints — rate limiting, credential stuffing detection, IP reputation scoring
- REST API requests — authentication verification, endpoint allowlisting, payload validation
- Admin AJAX — nonce verification support, user capability context, expected parameter shapes
- Comment and form submissions — content pattern analysis, bot detection, spam scoring
- WooCommerce checkout — transaction-safe processing with fraud signal detection that doesn’t interrupt legitimate purchases
The Failed Prototypes
Our first prototype blocked too much. We had aggressive rules that successfully stopped every SQL injection test we threw at it — and also broke the WordPress block editor, WooCommerce cart sessions, and the Hostinger dashboard integration. Not useful.
Our second prototype was too permissive. We whitelisted so many patterns to avoid false positives that we were letting through payloads that any reasonable WAF should have caught. The logs looked clean. The threat surface wasn’t.
The third prototype introduced the context-aware model — and it worked. Three months of June, July, and August 2025 was spent building, breaking, and refining it against a test environment with real WordPress installations running WooCommerce, Gutenberg, and the LiteSpeed Cache stack we deploy on Hostinger.
The result is a WAF that blocks real threats — SQL injection, XSS probes, path traversal, credential stuffing, malicious bot traffic — without generating the false positives that make other security plugins a liability on production sites.
Frequently Asked Questions
What makes a WordPress WAF different from a generic web application firewall?
WordPress generates traffic patterns that look suspicious to a generic WAF — HTML in POST bodies from the block editor, SQL-like strings in WooCommerce queries, complex AJAX requests from admin operations. A WordPress-native WAF is built with these patterns as the baseline, so it blocks real threats without generating false positives that break legitimate functionality.
How does the SwissWPSuite WAF handle WooCommerce checkout without false positives?
WooCommerce checkout processes complex POST data including product metadata, pricing, and session information that can trigger generic SQL injection rules. SwissWPSuite’s WAF applies context-aware logic to checkout endpoints — it validates the data structure expected for a legitimate transaction rather than scanning for raw keyword patterns.
What types of attacks does the SwissWPSuite WAF block?
SQL injection attempts, Cross-Site Scripting (XSS) probes, path traversal attacks, credential stuffing on login endpoints, brute-force login attempts, malicious bot traffic, XML-RPC abuse, and REST API endpoint probing. All rules are built specifically for WordPress and updated as new attack patterns emerge.