sandywp / plugins / block-bad-queries
BBQ Firewall
Fast & Powerful Firewall Security
The fastest firewall plugin for WordPress. Protect against a wide range of threats with minimal performance impact.
Ready in seconds.
v20260809 100,000+ installs WP 4.7+ PHP 5.6.20+
About this plugin
🔥 Install, activate, and done!
🔥 Powerful protection from WP’s fastest firewall plugin.
BBQ Firewall is a lightweight, blazing-fast firewall plugin that protects your site against a wide range of threats. BBQ checks all incoming traffic and quietly blocks bad requests containing nasty stuff like eval(, base64_, and excessively long request-strings. This is a simple yet solid solution for sites that are unable to use a strong Apache/.htaccess firewall.
🔥 Adds a strong firewall to ANY WordPress site
🔥 Works with all WordPress plugins and themes
Powerful Protection
BBQ protects your site against many threats:
- SQL injection attacks
- Executable file uploads
- Directory traversal attacks
- Unsafe character requests
- Excessively long requests
- PHP remote/file execution
- XSS, XXE, and related attacks
- Protects against bad bots
- Protects against bad referrers
- Protects against bad POST content
- Protects against many other bad requests
🔥 Works great with Blackhole for Bad Bots and Banhammer
Awesome Features
BBQ provides all the best firewall features:
- Rated 5 stars at WordPress.org
- 100% plug-&-play, zero configuration
- 100% focused on security and performance
- Blocks a wide range of malicious URL requests
- Fastest Web Application Firewall (WAF) for WordPress
- Based on the 7G/8G Firewall
- Scans all incoming traffic and blocks bad requests
- Scans all types of requests: GET, POST, PUT, DELETE, etc.
- Protects against known bad bots and referrers
- Works silently behind the scenes to protect your site
- Hassle-free security plugin that’s easy to use
- Thoroughly tested, error-free performance
- Extremely low rate of false positives
- Compatible with other security plugins
- Regularly updated and “future proof”
- Firewall < 10 kilobytes in size
- Lightweight, fast and flexible
🔥 For advanced protection and features, check out BBQ Pro »
Exclusive Pro Features
- Customize firewall via plugin settings
- Easily add or remove firewall patterns
- Easily add Jeff Starr’s AI Block List
- Send Email Alerts for blocked requests
- Quickly enable/disable firewall rules
- Disable firewall for logged-in users
- Block excessively long URI requests
- Protect against XML-RPC exploits
- Block any individual IP address
- Block entire ranges of IP addresses
- Protect against user-ID phishing
- Redirect all blocked requests
- Display a custom “blocked” message
- Set your own response status code
- Complete inline documentation
- Statistics for blocked requests
- Tools to reset options and patterns
- Import and Export firewall patterns
- One-click pattern testing
- Whitelist IP addresses
..plus everything the free version can do and more.
🔥 Learn more and get BBQ Pro »
Privacy
This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way.
BBQ Firewall is developed and maintained by Jeff Starr, 15-year WordPress developer and book author.
🔥 BBQ = Block Bad Queries
Support development
I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books:
- The Tao of WordPress
- Digging into WordPress
- .htaccess made easy
- WordPress Themes In Depth
- Wizard’s SQL Recipes for WordPress
And/or purchase one of my premium WordPress plugins:
- BBQ Pro – Blazing fast WordPress firewall
- Blackhole Pro – Automatically block bad bots
- Banhammer Pro – Monitor traffic and ban the bad guys
- GA Google Analytics Pro – Connect WordPress to Google Analytics
- Head Meta Pro – Ultimate Meta Tags for WordPress
- REST Pro Tools – Awesome tools for managing the WP REST API
- Simple Ajax Chat Pro – Unlimited chat rooms
- USP Pro – Unlimited front-end forms
Links, tweets and likes also appreciated. Thank you! 🙂
Questions
- How to test that the plugin is working?
Visit the plugin settings page and click the “Test Firewall” link.
- Do you offer any other security plugins?
Yes, three of them:
- BBQ Firewall for blazing-fast firewall security
- Blackhole for Bad Bots to protect your site against bad bots
- Banhammer to monitor and ban any user or IP address
Pro versions with more features available at Plugin Planet.
- Do I need to do anything else for BBQ to work?
Nope, just install and relax knowing that BBQ is protecting your site from bad URL requests.
- Where are the plugin settings?
No settings needed for BBQ! Everything is done automatically behind the scenes. Zero configuration required. The free version of BBQ is strictly plug-n-play, set-it-and-forget-it, with no settings to configure whatsoever. Just install, activate, and enjoy better security and robust protection against malicious requests. The Pro version is just as fast and simple to use, but is much more powerful and includes robust settings to customize and fine-tune your firewall.
- Is BBQ free version compatible with Wordfence?
Does it makes sense to use both? Yes BBQ free and BBQ Pro are both compatible with any plugin written according to WP APIs. And yes, there is benefit to using BBQ with any other security plugin, including Wordfence. They protect against different threats, so using both provides additional protection.
- Does BBQ make changes to my .htaccess file?
Absolutely not. Unlike other security/firewall plugins, neither BBQ (free version) nor BBQ Pro make any changes to any .htaccess file.
- Does BBQ make any changes to my WP database?
Only two tiny options are stored in the database; one option for the plugin version, and another option that stores an expiration date for the banner ad on the plugin settings page. Everything else happens at runtime. No other options are stored in the database. Also, both options are removed completely when the plugin is uninstalled via the WP Plugins screen.
- Does BBQ block malicious strings included in arrays?
Yes, BBQ scans any arrays that are included in the URI request. If any matching patterns are found, the request is blocked.
sandywp / also on the shelf
Try another plugin
4.5 · 60K+ installs
Adds a Google No Captcha ReCaptcha checkbox to your Wordpress and Woocommerce login, forgot password, and user registration pages.
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File…
4.8 · 30K+ installs
Smart WordPress security that blocks bots automatically, guides you to what matters, and repairs problems — without drowning you…
4.7 · 30K+ installs
Blackhole is a WordPress security plugin that detects and traps bad bots in a virtual black hole, where they are denied access to…
Spin up a real WordPress site in seconds.
Test plugins, build a demo, hand a client a link — then squash it and start again. No local setup, no Docker.