

<div>

  <h2>Quick Start Guide</h2>

  <ul>
    <li><a href="#firewall-installation">Firewall Installation</a></li>
    <li><a href="#proxy-configuration">Proxy Configuration</a></li>
    <li><a href="#ip-access-control">IP Access Control Rules</a></li>
    <li><a href="#country-access-control">Country-Based Access Control</a></li>
    <li><a href="#bruteforce-protection">Automatic Brute-Force Protection</a></li>
    <li><a href="#emergency-recovery">If You Get Locked Out of Your Site</a></li>
  </ul>

</div>

<br><br>

<h2 id="firewall-installation">Firewall Installation</h2>

<p>
  To install the firewall, open your WordPress admin dashboard and go to:
  <strong>WTB Firewall &rarr; Firewall</strong>
</p>

<p>
  On this page, click the <strong>Install</strong> button. The plugin will automatically install and configure
  the firewall for your site.
</p>

<p>
  After installation, the firewall may not start running immediately. On servers using PHP-FPM, it can take a few
  minutes before the firewall becomes active. The exact delay depends on your server configuration and how frequently
  PHP processes are restarted.
</p>

<p>
  The firewall itself is installed as the file <strong>wtb_firewall_main.php</strong> inside your
  <strong>uploads/wtb-firewall</strong> directory.
</p>

<p>
  You should never delete this file manually. If you need to remove the firewall, always do so from the plugin page
  using the uninstall option.
</p>

<br><br>

<h2 id="proxy-configuration">Proxy Configuration</h2>

<p>
  If your WordPress site is behind a proxy server, CDN, or load balancer, you must configure proxy support
  for the firewall to work correctly. Without this, the firewall may detect the proxy’s IP instead of the
  visitor’s real IP, which can cause incorrect blocking, logging errors, or even lock you out of your own site.
</p>

<p>
  To configure proxy support, go to your WordPress admin dashboard and open:
  <strong>WTB Firewall &rarr; Firewall</strong>
</p>

<p>
  Scroll down to the <strong>Proxy Support</strong> section.
</p>

<p>
  Here you need to configure two things:
</p>

<p>
  First, enter the correct IP address (or IP range) of your proxy server. This tells the firewall which
  connections are coming from a trusted proxy instead of a normal visitor.
</p>

<p>
  Second, select the correct header used by your proxy to forward the real visitor IP address. Different
  providers use different headers, such as <code>X-Forwarded-For</code>, <code>CF-Connecting-IP</code>, or others.
  You must choose the header your server actually sends.
</p>

<p>
  If these settings are incorrect, the firewall may:
</p>

<ul>
  <li>Block legitimate visitors</li>
  <li>Fail to block attackers</li>
  <li>Log the wrong IP addresses</li>
  <li>Or block your own admin sessions</li>
</ul>

<p>
  If you are unsure which values to use, check your hosting provider’s documentation or ask their support
  which proxy IPs and headers they use.
</p>

<p>
  After saving your proxy settings, it is recommended to test access to your site from another browser or
  device to confirm that IP detection is working correctly before enabling strict blocking rules.
</p>

<br><br>

<h2 id="ip-access-control">IP Access Control Rules</h2>

<p>
  To block or allow an IP address, go to your WordPress admin dashboard and open:
  <strong>WTB Firewall &rarr; Firewall Rules</strong>
</p>

<p>
  On this page, you will find a form for creating new firewall rules.
</p>

<p>
  You can choose to explicitly <strong>Block</strong> or <strong>Allow</strong>:
</p>

<ul>
  <li>A single IP address (IPv4 or IPv6)</li>
  <li>A range of IP addresses (CIDR notation supported)</li>
</ul>

<p>To create a rule:</p>

<ol>
  <li>Select whether the rule should <strong>Block</strong> or <strong>Allow</strong> traffic.</li>
  <li>Enter the IP address or IP range.</li>
  <li>Save the rule.</li>
</ol>

<p>
  Block rules will deny access to matching visitors before WordPress fully loads.
  Allow rules can be used to whitelist trusted IP addresses, such as your own office or home connection.
</p>

<p>
  When using IP ranges, make sure you understand the scope of the range you are entering.
  Blocking a large range may unintentionally affect legitimate visitors.
</p>

<p>
  After saving a rule, it becomes active immediately. If you are blocking IP addresses manually,
  always double-check that you are not blocking your own current IP address.
</p>

<p>
  For safety, it is recommended to create an allow rule for your own IP address before adding strict block rules.
</p>

<br><br>

<h2 id="country-access-control">Country-Based Access Control</h2>

<p>
  To block or allow visitors based on their country, go to your WordPress admin dashboard and open:
  <strong>WTB Firewall &rarr; Country Rules</strong>
</p>

<p>
  On this page, you can create rules that apply to all connections from a specific country.
</p>

<p>To add a rule:</p>

<ol>
  <li>Select a country from the dropdown menu.</li>
  <li>Choose whether you want to <strong>Block</strong> or <strong>Allow</strong> connections from that country.</li>
  <li>Save the rule.</li>
</ol>

<p>
  Country detection is based on IP geolocation. While this is generally accurate, it is not perfect, and some visitors
  may appear from a different country if they use VPNs, mobile networks, or corporate proxies.
</p>

<p>
  After saving a country rule, it becomes active immediately.
</p>

<br><br>

<h2 id="bruteforce-protection">Automatic Brute-Force Protection</h2>

<p>
  The firewall can automatically block IP addresses that repeatedly fail authentication, helping protect your site from
  brute-force login attacks.
</p>

<p>
  To configure this feature, go to your WordPress admin dashboard and open:
  <strong>WTB Firewall &rarr; Automatic Protection</strong>
</p>

<p>
  On this page, you will find a form where you can enable automatic blocking for failed authentication attempts.
</p>

<p>You can configure:</p>

<ul>
  <li>How many failed login attempts are allowed before an IP address is blocked</li>
  <li>Over what time period those failed attempts are counted</li>
</ul>

<p>
  Be careful not to set these values too strict. If the limits are too low or the time window too long, legitimate users
  &mdash; including yourself &mdash; may be blocked accidentally if they mistype their password or have trouble logging in.
</p>

<p>
  After saving your settings, the protection becomes active immediately. It is recommended to test the login process once
  to confirm everything behaves as expected and that you are not blocking yourself or other legitimate users.
</p>

<br><br>

<h2 id="emergency-recovery">If You Get Locked Out of Your Site</h2>

<p>
  If the firewall blocks your access to the WordPress admin area, you can disable it quickly and regain access.
</p>

<h3>Step 1 &mdash; Disable the Firewall Configuration</h3>
<ol>
  <li>Connect to your site using FTP, SFTP, or your hosting file manager.</li>
  <li>Open the folder: <code>/wp-content/uploads/wtb-firewall</code></li>
  <li>Locate the file: <code>wtb_firewall_config.php</code></li>
  <li>Delete the file <code>wtb_firewall_config.php</code>.</li>
</ol>

<p>
  Deleting this file immediately disables the firewall and should restore normal access to your site.
</p>

<h3>Step 2 &mdash; Log Back Into WordPress</h3>
<ol>
  <li>Open your WordPress login page.</li>
  <li>Log in normally.</li>
  <li>Your access should now be restored.</li>
</ol>

<h3>Step 3 &mdash; Uninstall the Firewall From Inside the Plugin</h3>
<ol>
  <li>In your WordPress dashboard, go to <strong>WTB Firewall &rarr; Firewall</strong>.</li>
  <li>Click the <strong>Uninstall Firewall</strong> button.</li>
</ol>

<p>
  This removes the firewall configuration and disables all active firewall rules, while keeping the plugin installed.
</p>

<h3>Step 4 &mdash; Review What Caused the Lockout</h3>
<p>Before enabling the firewall again, review your settings and rules, especially:</p>
<ul>
  <li>IP block/allow rules you added manually</li>
  <li>Country blocking settings</li>
  <li>Proxy settings (incorrect headers can cause wrong IP detection)</li>
  <li>Auto-blocking thresholds that may be too strict</li>
</ul>

<p>
  After reviewing and adjusting your rules/settings, you can reinstall and enable the firewall again from the same page.
</p>
