Rules tailored to your site
Inspect malicious input, review traffic exceptions, and apply bot policies using available network evidence, not a user-agent alone.
Trust the network, not the name →WordPress & PHP security
A firewall blocks the attack.BitFire blocks the damage.
BitFire Pro stops exploited plugins from changing your files, database, or administrator accounts - even when the vulnerability is brand new.
- Typical setup: 5 minutes
- No credit card required
Protection at every layer
Application
Filesystem
Database
Write Lock
Prevent any vulnerability from infecting your site with malware
4,000+
Configurable bots with pre-configured access controls
A+
Rated WAF & RASP · rated by Cloudbric
< 5 min
Setup time · Click configure or copy config files
Protection you can verify
See exactly what’s protected.
Runtime Application Self-Protection (RASP) checks what your application tries to do, not just the request that reached it. BitFire Pro adds authorization checks to protected file and database operations, complementing the firewall’s request filtering.
The 100% scores in this product example describe the controls assessed for that configuration, not protection against every vulnerability, and not independent certification.
Explore BitFire Pro runtime controls →
- Coverage scores summarize assessed configuration controls.
- Protection switches show which controls are enabled.
Watch BitFire in action
A two-minute product tour.
See request filtering and Pro runtime protection in action.
One protection layer is not enough
Filter. Enforce. Investigate.
Three jobs, with the evidence to review what happened.
Protect operations with Pro
Check authorization for protected PHP writes, database operations, and administrator changes. Coverage depends on enabled controls.
Review runtime controls →Find suspicious code
Behavioral scanning flags potentially malicious code. AI-assisted analysis helps you review what to allow, repair, or remove. A flag is not proof of infection, and AI analysis can be mistaken. Review evidence and back up files before changes.
Understand why it was flagged →Swipe or scroll across the image; expand for full-size details.
- Filter requests to narrow the activity you review.
- Read the decision alongside the request and rule.
- Check the source alongside client and network information.
Vulnerability protection
Built for real WordPress attack paths.
BitFire is designed to protect the places attackers target most: malicious requests, unauthorized file changes, suspicious database activity, and abusive bot traffic. Our vulnerability writeups show how those protection layers apply to real WordPress security issues.
Selected protection examples
Real WordPress vulnerabilities from the 2024–2026 article collection
Each example connects a known vulnerability pattern to BitFire controls that can help block exploitation, limit damage, and surface evidence for review. Use BitFire as an active protection layer while keeping WordPress, themes, and plugins updated.
| Component | Official CVE record | CNA CVSS 3.1 | Assessed BitFire controls |
|---|---|---|---|
| Forminator Forms | CVE-2026-92229 official recordCVE published 2026-09-19 Metadata checked 2026-09-21 |
9.1 · Critical | Bot policy + Pro runtime controls Assesses automated Forminator exploit delivery and unauthorized privileged actions invoked through injected shortcodes. Results depend on client policy, shortcode behavior, and enabled runtime controls. |
| The Events Calendar | CVE-2026-78159 official recordCVE published 2026-09-12 Metadata checked 2026-09-21 |
9.8 · Critical | Bot policy + Pro file and administrator controls Assesses automated comment-delivery blocking and unauthorized PHP-file or administrator persistence after callable injection. Results depend on comment reachability, client policy, and enabled runtime controls. |
| JetFormBuilder | CVE-2026-12793 official recordCVE published 2026-09-16 Metadata checked 2026-09-21 |
9.8 · Critical | Bot policy + Pro administrator controls Assesses automated JetFormBuilder exploit delivery and unauthorized administrator account creation. Results depend on schema reachability, client policy, and enabled runtime controls. |
-
CVE-2026-92229 · Official record
Forminator Forms
Bot policy + Pro runtime controls
Assesses automated Forminator exploit delivery and unauthorized privileged actions invoked through injected shortcodes. Results depend on client policy, shortcode behavior, and enabled runtime controls.
Read analysis : Forminator Forms -
CVE-2026-78159 · Official record
The Events Calendar
Bot policy + Pro file and administrator controls
Assesses automated comment-delivery blocking and unauthorized PHP-file or administrator persistence after callable injection. Results depend on comment reachability, client policy, and enabled runtime controls.
Read analysis : The Events Calendar -
CVE-2026-12793 · Official record
JetFormBuilder
Bot policy + Pro administrator controls
Assesses automated JetFormBuilder exploit delivery and unauthorized administrator account creation. Results depend on schema reachability, client policy, and enabled runtime controls.
Read analysis : JetFormBuilder
Showing 3 of 17 protection records. Index rebuilt September 21, 2026. Official CVE records provide vulnerability details used to map relevant BitFire request, bot, file, and database protections.
View all protection records
Customer confidence
Trusted by site owners who need real protection.
BitFire helps teams secure WordPress sites, recover from threats, and keep protection in place as attacks evolve.
Trond André
BitFire customer
“It works!”
Mark Sullivan
BitFire customer
“The team at BitFire walked us through the entire install process, removed all the malware, and fully protected all our sites. I’ll never run a site without it again.”
Fast path to protection
From installation to enforcement.
BitFire integrates with WordPress and its PHP runtime, builds a baseline of legitimate traffic, and applies your configured protection controls.
01
Connect your website
Typical setup takes five minutes, followed by a traffic-learning period. Free for non-commercial sites; business sites require Pro.
02
Build a site-specific baseline
Adaptive rules learn what your real visitors, applications, browsers, and approved bots need.
03
Review, then enforce
Review exceptions before enforcement. Pro adds runtime authorization checks to the firewall’s request filtering.
Choose your protection
Start with basic protection. Upgrade for stronger security.
BitFire Free helps add essential protection to a site. BitFire Pro adds deeper safeguards for sites where security, uptime, and active enforcement matter most.
Basic protection
Free
Essential firewall, bot, and malware scan tools for sites that need a simple protection baseline.
- Firewall and bot blocking / verification
- Manual malware scanning
- 12 AI credits for the lifetime of the domain
- Self-managed setup with a fast path to protection
Advanced site security
Pro
Deeper protection for sites that want stronger assurance, runtime enforcement, scheduled scanning, and more security visibility.
- Firewall and bot protection, plus Always-On Protection
- Runtime file, database, and administrator protection
- Scheduled malware scans and Threat Hunter
- 1,000 AI malware analysis credits; self-managed by default
Paid Pro add-ons
Managed
Let BitFire handle installation and ongoing care.
- Installation, configuration, and operational tuning
- Ongoing monitoring and legitimate-traffic review
- Managed Protection: normal U.S. business hours
- Priority Support: 24/7 coverage and a one-hour response time
Want help choosing the right protection level or support option? Talk with a security engineer about your site, risks, and operating needs.
Explore the details: protection features · malware scanning · licensing and support.
For site owners, agencies, and security teams: explore portfolio and enterprise use cases →
Compare request filtering and runtime enforcement
This compares control boundaries, not named products, their current features, or test results.
| Control boundary | Request filtering | Runtime enforcement |
|---|---|---|
| Main question | Should this request reach the application? | Is this protected operation authorized? |
| Signals | Request content, client identity, and traffic policy | Application identity, permissions, and the operation attempted |
| Enforcement point | Before the request reaches the vulnerable handler | When application code attempts a protected action |
| Examples in BitFire | Bot policies and SQL-injection request inspection | Pro checks on protected PHP writes and administrator changes |
| Limits | Coverage depends on inspection, rules, and exceptions | Coverage depends on supported operations, configuration, and authorization context |
Neither layer replaces patching, access control, or recovery planning. Review BitFire’s documented controls and configuration requirements →
Questions, answered
What teams ask before installing.
Need to evaluate BitFire for a specific stack? Talk directly with a security engineer.
Talk to a security engineerHow do BitFire’s firewall and runtime controls work together?
The firewall evaluates incoming requests. BitFire Pro also checks authorization when WordPress attempts protected file, database, or administrator operations. These are complementary controls; capabilities vary across security products and configurations.
Does BitFire only work with WordPress?
The current product is for WordPress and its PHP runtime. For a standalone PHP application, contact the team to confirm availability and compatibility before planning a deployment.
Can BitFire help with an already hacked website?
The scanner can help you investigate suspicious files. For cleanup or incident-response assistance, contact a security engineer to confirm the work and service scope. Installing a firewall does not by itself remove an existing compromise.
How should we measure protection overhead?
Overhead depends on hosting, PHP and plugin activity, enabled controls, traffic, and cache state. We do not publish a fixed latency figure here because a reproducible benchmark report is not available for this page.
Recommended measurement procedure, not a published test result:
- Use an isolated staging copy. Record CPU, memory, PHP, WordPress and BitFire versions, plugins, cache settings, enabled controls, and traffic-learning state.
- Use the same representative page, login, form, and API requests at a fixed request rate. Record cache state, warm-up, duration, repetitions, and sample count.
- Compare a baseline, firewall/bot controls, and Pro runtime controls separately. Record server processing time, median and 95th-percentile response time, errors, and CPU use for each run.
- Report the differences with the configuration and raw results. Do not disable protection on a live site for benchmarking.
How does BitFire handle legitimate bots?
BitFire can allow a bot from anywhere, authenticate it by source network, or block it completely. Network validation makes it harder for an attacker to bypass controls using a spoofed user-agent string.
Can we keep our current edge firewall or CDN?
BitFire’s runtime protection is designed to add application-level enforcement behind the edge. For enterprise environments, confirm the exact deployment pattern and compatibility requirements with the BitFire team.
Choose your next step
Start protecting your site.
Start protecting a site in minutes, or bring us your architecture and security requirements for a technical walkthrough.
Protect my site freeProtecting a business site? View Pro.