# Block Malicious Request Patterns

> A tiny firewall that returns 403 Forbidden for URLs containing typical attack strings, such as directory traversal, SQL injection and PHP stream wrappers.

- Type: PHP
- Runs: Run everywhere
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, firewall, requests
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/block-malicious-request-patterns/

## Code

```php
// Patterns checked against the decoded URL (path and query string).
$wpide_firewall_patterns = array(
    '#\.\./#',
    '#(?:/|%2f)etc/passwd#i',
    '#(?:php|phar|zip|data|expect)://#i',
    '#union(?:\s|\+|/\*.*\*/)+(?:all(?:\s|\+)+)?select#i',
    '#\b(?:base64_decode|eval|assert|shell_exec|passthru|system)\s*\(#i',
    '#<\s*script#i',
    '#(?:GLOBALS|_REQUEST|_SERVER)\s*\[#',
    '#wp-config\.php#i',
);

add_action( 'init', function () use ( $wpide_firewall_patterns ) {
    if ( empty( $_SERVER['REQUEST_URI'] ) || ( is_user_logged_in() && current_user_can( 'unfiltered_html' ) ) ) {
        return;
    }

    $uri = rawurldecode( rawurldecode( (string) wp_unslash( $_SERVER['REQUEST_URI'] ) ) );

    foreach ( $wpide_firewall_patterns as $pattern ) {
        if ( preg_match( $pattern, $uri ) ) {
            status_header( 403 );
            nocache_headers();
            exit( 'Forbidden' );
        }
    }
}, 0 );
```

## Notes

Form submissions are not inspected, so editors keep working, and it complements rather than replaces a real web application firewall.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Block Malicious Request Patterns" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/