Web Application Firewall Setup
When the Wordfence Web Application Firewall is first installed, at the top of WordPress admin pages, you will see "To make your site as secure as possible, take a moment to setup the Wordfence Web Application Firewall."
When you click the "Click here to configure" button, the setup page will detect the server configuration for your site. You should not need to change this option, but you can, if you know that your server configuration is not detected correctly. Click the Continue button.
The next page may recommend downloading one or more files (.htaccess and .user.ini) for backup purposes, in case your host does not support this setup. You can upload these files back to your site if there are any problems. Once you have downloaded the files, you can click Continue to complete the setup
Solutions to Error Messages and Setup Issues
If you see error messages about file permissions, check if you have another security plugin that changes permissions, and temporarily set the files or directories to be writable. If you have previously set file permissions manually, make sure that the web server user can write to these files or directories temporarily.
This only needs to be done during the initial firewall setup process, so you can re-enable other security measures after setup is complete.
Possible error messages include:
- We were unable to create the wordfence-waf.php file in the root of the WordPress installation
- This means that new files cannot be written to the main folder of your site
- We were unable to make changes to the .htaccess file.
- Check to make sure that the .htaccess file can be written by the web server user, and then try the process again
- We were unable to make changes to the .user.ini file.
- Some server configurations need this file in addition to .htaccess
- Some hosts may use a different filename
- If you don't already have the file mentioned in the message, make sure the main folder of the site is writable
Each of these issues can be solved by temporarily disabling permissions changes made by other security plugins, or by manually adjusting permissions.
Other installation issues
If you have other security measures that prevent the necessary files from being updated, or if you have manually set file permissions, you can set up the firewall manually. When you click the "Click here to configure" button, follow the directions at the bottom of the page below the Alternate Method heading.
Depending on your server configuration, you may be prompted to create wordfence-waf.php, and edit or create .htaccess or .user.ini files in the site's main directory.
Still need help?
If you cannot complete the setup and the steps above do not help, you can contact us on the support forum if you are a free customer or open a ticket if you are a premium user.