Writing firewall rules from scratch takes time, and it is easy to miss something. Firewall Shortcuts give you a set of pre-built rules for the most common security scenarios so you can get protected quickly without having to figure out the expression syntax yourself. You pick a shortcut, check what it does, and add it as a rule in one click.

This article walks through what Firewall Shortcuts are, what each category covers, and how to use them to secure your site.

What Are Firewall Shortcuts

Firewall Shortcuts are ready-to-use rule templates built around the security needs most websites share. Each shortcut already has an action assigned to it, either Block, Challenge, or Bypass, and includes a description so you know what you are enabling before you commit to it.

They are grouped into four categories: Access Control, Bots & Abuse, App Protection, and Trusted Traffic. The grouping reflects intent, so if you are trying to restrict who can reach your site, manage crawler access, lock down sensitive endpoints, or carve out exceptions for internal services, you are looking in the right place within a few seconds.

Firewall Shortcut Categories

Access Control

Access Control shortcuts filter traffic based on where it is coming from, whether that is a specific IP, a country, or a hostname mismatch. Because these rules fire before anything else touches the request, they are usually the first ones worth setting up.

Block Other Hostnames 
Drops requests that target a hostname other than your primary domain. In shared-zone setups where multiple domains point to the same infrastructure, this keeps unwanted hostname-based traffic from slipping through.

Block wp-admin Access
Locks down the WordPress admin panel to whitelisted IPs only. The /wp-admin path gets probed constantly, so limiting it to addresses you actually control cuts off the vast majority of brute-force and credential-stuffing attempts before they even get a chance to run.

Geo Blocking 
Blocks traffic coming from specific countries or regions. If your site does not serve users in certain parts of the world and those regions are a regular source of bad traffic, this shortcut lets you cut them off cleanly.

IP Blocking 
Restricts access from individual IP addresses or ranges you specify. It works both proactively, for known bad actors, and reactively, when you need to lock out a source that is actively causing problems.

Bots & Abuse

The Bots & Abuse section handles automated traffic. That includes legitimate crawlers you want to let through and abusive bots you want to slow down or stop. The shortcuts here let you deal with both without writing rules from scratch for each one.

Known crawlers from search engines and major platforms, including GoogleBot, BingBot, AppleBot, DuckDuckBot, YandexBot, BaiduspiderBot, AmazonBot, FacebookBot, LinkedInBot, and SemrushBot, are set to Bypass. This means indexing, link previewing, and SEO tooling keep working even when your other firewall rules are fairly aggressive.

AI crawlers from Anthropic and OpenAI, specifically ClaudeBot, ChatGPT-User, and GPTBot, are also available as Bypass shortcuts. Adding them gives you explicit control over AI crawler access rather than leaving them at the mercy of generic bot rules.

CAPTCHA Challenge for Abused IPs
Applies a CAPTCHA to IPs that have been flagged as likely abusive. The logic here is that a real person behind a flagged IP can still get through by solving the challenge, while bots cannot.

Challenge Empty User Agent
Targets requests that do not send a User-Agent header at all. Legitimate browsers and crawlers always identify themselves, so an empty User-Agent is usually a sign of something automated and low-effort.

JA3 Mismatch with Browser
Compares what the User-Agent claims to be with the actual TLS fingerprint of the connection. Bots often impersonate real browsers at the User-Agent level but cannot replicate the underlying fingerprint correctly. When the two do not line up, the shortcut issues a CAPTCHA challenge.

App Protection

App Protection shortcuts target the parts of your application that attackers go after most often: login pages, write endpoints, admin paths, and files that should not be publicly reachable.

Block Sensitive File Types
Prevents access to config files, database dumps, and backup archives. These files should never be publicly accessible, and this shortcut ensures they are not even if they end up in a web-accessible location by mistake.

Block Suspicious Query Patterns
Looks at incoming query strings and blocks anything that resembles a SQL injection probe. The check happens before the request reaches your application, which is where you want it.

Form Submission Protection
Blocks anything other than POST requests to your form endpoints. Since legitimate form submissions always use POST, blocking other methods on those paths is generally safe. You will need to set the correct path for your form endpoint before saving the rule.

Hotlink Protection
Blocks asset requests that come from external referrers while letting direct visits through. This stops other sites from embedding your images or files and running up your bandwidth costs.

Login Path Protection
Adds a JavaScript challenge to your login and admin paths. Real users pass it without noticing. Automated tools trying to brute-force credentials do not. Update the path to match your actual login URL before enabling this one.

POST Only Endpoint Protection
Restricts a write endpoint to POST requests only. If you have an API endpoint that should only ever receive data submissions, this rule enforces that. Like Form Submission Protection, the path needs to be updated before saving.

Protect Admin API Paths
Challenges traffic to common admin and internal API prefixes. It is not a hard block, so authorized users can still get through, but it stops automated probing from getting anywhere.

Protect XML RPC
Blocks abuse of XML-RPC endpoints. This is a frequent attack vector for WordPress sites. If your application does not specifically rely on XML-RPC, enabling this rule is a straightforward win.

Trusted Traffic

Trusted Traffic shortcuts work in the opposite direction. Instead of adding restrictions, they create exceptions for paths or services that should not be subject to security checks.

Bypass Rate Limit for Internal APIs
Excludes health-check and status endpoints from rate limiting. Without this, monitoring systems that poll those endpoints frequently can trigger rate limit blocks, which creates noise and can interfere with how your infrastructure tracks availability.

Exclude from WAF
skips WAF inspection for specific paths or services you define. Use this only where you are certain the path does not need WAF coverage, or where another control is already handling that traffic.

How to Add a Firewall Shortcut

1. Go to Security in your dashboard and open the Firewall Shortcuts.
2. Check the action badge on the card so you know whether it will Block, Challenge, or Bypass matching traffic.
3. Click Add Rule.
4. If the shortcut requires a path, such as Form Submission Protection, Login Path Protection, or POST Only Endpoint Protection, update the path to match your actual endpoint before saving.
5. Verify the rule shows up in your active firewall rules list.

Understanding the Action Types

Each shortcut has a pre-set action that controls what happens when the rule matches a request.

A Block action rejects the request immediately. The visitor gets an error and cannot continue. Use this when you are certain the traffic should never reach your site.

A Challenge action asks the visitor to complete a CAPTCHA or pass a JavaScript verification before proceeding. This works well when you want to stop bots without turning away real users.

A Bypass action lets the request through without any security inspection. This is meant for crawlers you trust, internal tools, and monitoring endpoints that would otherwise run into rate limits or WAF rules they do not need to be subject to.

FAQs

1. Can I edit a shortcut after I have added it as a rule?
Yes. Once it is in your rules list, it works like any rule you wrote yourself. You can change the conditions, update the path, switch the action, or adjust its priority whenever you need to.

2. What if I add a path-dependent shortcut without updating the path first?
The rule will apply to the placeholder path that ships with the shortcut, not your actual endpoint. It will not do anything useful until you set the correct path. Always update it before saving.

3. Is it safe to bypass crawlers like GoogleBot and ClaudeBot?
Yes, as long as the shortcut is using verified bot identity checks rather than just the User-Agent string. User-Agent values can be spoofed, so verified identity is what you want to rely on. Bypassing known legitimate crawlers is generally the right call since blocking them disrupts indexing and SEO.

4. Do I have to add shortcuts one at a time?
Yes, each one is added individually. For most shortcuts it is just one click, so adding several in a row does not take long. The ones that need a path update require a bit more attention, but it is still a quick process.

5. Should I turn on all the App Protection shortcuts straight away?
Most of them are safe to enable for a standard web application. The ones to be careful with are Form Submission Protection, Login Path Protection, and POST Only Endpoint Protection, since they all need the correct path set before they will work as intended. If you are not sure, test in a staging environment first.