Jetpack WAF (Web Application Firewall)

Jetpack’s WAF (Web Application Firewall) examines incoming traffic to a WordPress site and decides to allow or block it based on various rules. This adds an important layer of protection to your site, particularly when attackers actively exploit unpatched vulnerabilities.

Looking for more information about using the WAF with the Jetpack Protect plugin? See our article about the Jetpack Protect Plugin.

With Jetpack Firewall, you can configure IP addresses that will never or always be blocked (regardless of the automatic rules). To allow or block incoming traffic based on automatic rules, you will need one of these plans: Jetpack Pro, Jetpack Complete, or Jetpack Scan (or an existing Jetpack Security subscription), and a connection to your WordPress.com account.

If you previously had a Jetpack plan that includes Jetpack Scan and/or your site becomes disconnected from your WordPress.com account, you will continue to have access to the firewall settings in your Jetpack dashboard. This is to ensure that your IP allow/block lists and previous firewall rules remain functional.

Turning on the firewallMD

Jetpack Firewall is deactivated by default when you connect Jetpack to your WordPress.com account. You can activate it at any time from the Protect page in WP Admin. To enable Jetpack WAF:

1. Go to Jetpack → Protect in WP Admin and click the Settings tab.
2. Turn on “Enable firewall” in the Firewall section.

If the standalone Jetpack Protect plugin is active, the Jetpack menu does not show this Protect page, and your site keeps the earlier screens. To use the firewall with that plugin, see Jetpack Firewall in the Jetpack Protect Plugin. On Jetpack versions before 16.4, select Jetpack → Settings → Security → Firewall and enable Protect your site with Jetpack’s Web Application Firewall.

Configure your firewallMD

Your firewall comes with the following options in the Firewall section at Jetpack → Protect → Settings:

• Automatic firewall rules: Protect your site against untrusted traffic sources with automatic security rules. This option requires a paid plan: Jetpack Pro, Jetpack Complete, or Jetpack Scan, or an existing Jetpack Security subscription.
• Block these IP addresses: This option allows you to add an IP block list.
• Share basic data with Jetpack: You allow Jetpack to collect basic data from blocked requests to improve firewall protection and accuracy. You can check Jetpack Privacy before you set this option.
• Share detailed data with Jetpack: You allow Jetpack to collect detailed data from blocked requests to improve firewall protection and accuracy. You can check Jetpack Privacy before you set this option.

Block specific IP addresses from accessing your siteMD

To add IP addresses to a block list:

1. Go to Jetpack → Protect in WP Admin and click the Settings tab.
2. In the Firewall section, turn on “Block these IP addresses“. This option is available once the firewall is on.
3. Enter IP addresses in the “Blocked IP addresses” field. Separate IPs with commas, spaces, or new lines. IPv4 and IPv6 are supported. To specify a range, use CIDR notation (i.e. 12.12.12.0/24) or enter the low value and high value separated by a dash (i.e. 12.12.12.0–12.12.12.255).
4. Click Save.

Jetpack won’t save a block list that includes your own IP address. On Jetpack versions before 16.4, select Jetpack → Settings → Security → Firewall, enable Manual rules – Block specific IP addresses from accessing your site, and click Save block list instead.

Add always-allowed IP addresses to your security settingsMD

You can prevent Jetpack’s security features from blocking specific IP addresses. This will apply to both brute force protection and firewall rules.

Here is how to add IP addresses to the allowlist:

1. Go to Jetpack → Protect in WP Admin and click the Settings tab.
2. In the Firewall section, turn on “Always allowed IP addresses“. This option is available once the firewall is on.
3. Enter IP addresses in the field that appears. Separate IPs with commas, spaces, or new lines. IPv4 and IPv6 are supported. To specify a range, use CIDR notation (i.e. 12.12.12.0/24) or enter the low value and high value separated by a dash (i.e. 12.12.12.0–12.12.12.255).
4. Click Save.

To add the address you’re using now, click Add my IP address before you save. The button shows only when your current address isn’t on the list yet. On Jetpack versions before 16.4, select Jetpack → Settings → Security → Always allowed IP addresses, turn on Prevent Jetpack’s security features from blocking specific IP addresses, and click Save allow list instead.

TroubleshootingMD

What happens if I don’t renew my Scan subscription?

Any rules delivered to the site will remain functional after your Jetpack Scan subscription lapses or is removed.

Can I use the IP allow and block lists behind a reverse proxy (like Cloudflare)?

The IP allowlists and blocklists currently have no way to configure trusted proxies and trusted headers and thus won’t work behind any sort of reverse proxy or load balancer setup.

My site went down after I activated the Firewall feature.

If you need to deactivate the firewall without access to the Jetpack settings screen, you can:

• Modify your wp-config.php: add the line define( 'DISABLE_JETPACK_WAF', true ); to your wp-config.php file
• Use WP-CLI: if you have WP-CLI installed, use the command wp jetpack-waf teardown

Privacy InformationMD

This feature is deactivated by default. It can be activated at any time at Jetpack → Settings → Security → Firewall and by clicking on Protect your site with Jetpack’s Web Application Firewall.

Data Used
Site Owners / Users This feature evaluates the incoming HTTP requests and blocks them if they’re considered malicious. User data is used to authenticate some of our APIs. Installed themes and plugins and WordPress version are used to know which versions we should check against the WPScan API in the free version of the WAF.	Site Visitors None.
Activity Tracked
Site Owners / Users If the Share data with Jetpack checkbox is selected we track which rules caused a request to be blocked. We don’t track actual request data with this option. Jetpack Firewall also tracks when settings in the Firewall settings are turned on or off. If the Share data with Jetpack checkbox is selected we track the following data of requests that trigger a WAF block: Information about the rule that triggered the blockRequest URIUser agentRefererContent typeGET params If the Share detailed data with Jetpack checkbox is selected we also track the following data for requests that triggered the block alongside the previously mentioned data: POST params Header data	Site Visitors None.
Data Synced (Read More)
Site Owners / Users Information about users/admins, installed themes and plugins, and WordPress version.	Site Visitors None.

For general features and FAQs, please see our Jetpack Security features.