First steps with Shieldix

Learning mode

For the first 7 days the firewall only records what it would block, so you can review it before blocking starts.

While it learns, attacks show as “Recorded (learning)” in the event log. Blocking starts by itself when learning ends, and Shieldix can email you when it does. To start blocking earlier, choose Protect under Settings → Mode.

Never block

The firewall never blocks addresses on the “Never block” list: your office, your monitoring service, your own servers. Add an address or a CIDR range under Settings, or click “Never block” next to an event. Adding an address also lifts its current block.

The Shieldix Cloud panel has its own never-block list for all your sites; adding an address there lifts its Shieldix Cloud blocks at once.

Switch Shieldix off

If a block ever stands in your way and you cannot reach the WordPress admin, add this line to wp-config.php:

define( 'SHIELDIX_DISABLE', true );

The firewall reads the line itself, so it works in every mode, even before WordPress loads. Shieldix then lets every request through and sends no emails. Remove the line to switch protection back on.

WP-CLI

Shieldix also works from the command line:

wp shieldix status

Shows the firewall mode, how many requests were blocked, the hardening measures, the setup check, the last file scan and known vulnerabilities.

wp shieldix mode protect

Sets the firewall mode: learning (record only) or protect (block).

wp shieldix unblock 203.0.113.7

Removes an address from the blocklist.

wp shieldix allow 203.0.113.7

Adds an address or a CIDR range to the never-block list.

wp shieldix scan

Runs a full file scan now and lists the findings.

wp shieldix emergency --all --user=<your-login>

Emergency lockdown: signs everyone out, revokes application passwords, sets new security keys and resets the other administrators' passwords. Run it as your own administrator, so that your password stays.

There are also commands for known vulnerabilities (wp shieldix vulns), settings import and export and Shieldix Cloud. wp help shieldix lists them all.

Connect a site to Shieldix Cloud

In the Shieldix Cloud panel, open Sites and create a link code (XXXX-XXXX-XXXX). The code works once, within 1 hour.

In WordPress, open Shieldix → Settings, read what is sent, tick “I agree that this site sends the data above to Shieldix Cloud”, enter the code and click Connect. Or, from the command line:

wp shieldix cloud link XXXX-XXXX-XXXX --consent

Nothing is sent before you connect. See what is sent to Shieldix Cloud.

You can disconnect at any time, in the plugin, in the panel or with wp shieldix cloud unlink. The plugin keeps protecting the site on its own.