Skip to content

For‐Administrators

Jump to bottom
Mikhail Deynekin edited this page Jan 23, 2026 · 3 revisions

For Administrators

This guide is designed for WordPress administrators responsible for configuring and managing the CF7 Spam Checker security infrastructure.

📊 Dashboard Overview

Navigate to CF7 Security → Dashboard to access the main control panel.

Key Metrics

  • Total Attacks: Cumulative count of all detected malicious attempts since plugin activation.
  • Attacks (24h): Real-time threat monitoring for the past 24 hours.
  • Banned IPs: Current number of blocked IP addresses.
  • Protected Forms: Count of CF7 forms actively monitored by the plugin.

Attack Statistics Visualization

The dashboard provides a 7-day breakdown of attack types:

  • SQL injection attempts
  • XSS (Cross-Site Scripting) vectors
  • CSRF token violations
  • Rate limit breaches
  • Bot detection triggers
  • File upload validation failures

🛡 Security Configuration

Navigate to CF7 Security → Settings to configure protection modules.

Language Validation

  • Enable Validation: Master switch for character set checking.
  • Language Selection: Choose from 20+ supported languages (English, Russian, Chinese, etc.).
  • Extra Russian Validation: Additional Cyrillic check for multilingual sites.

Protection Modules

  • SQL Injection Protection: Blocks database manipulation attempts.
  • XSS Protection: Prevents malicious script injection.
  • CSRF Protection: Validates WordPress nonces.
  • Bot Detection: Filters automated submissions.
  • File Upload Validation: MIME type validation and size limits (10MB).

Rate Limiting Settings

  • Max Requests/Minute: Default 20 (adjust based on site traffic).
  • Ban Threshold: Number of violations before permanent ban (default 50).
  • Ban Duration: Temporary ban length in hours (default 1 hour).

🌐 IP Access Management

Blacklist Operations

Viewing Banned IPs: Navigate to CF7 Security → IP Management to view the ban list with columns:

  • IP Address
  • Reason (e.g., "SQL Injection Detected")
  • Banned At (timestamp)
  • Expires (time or "Never")
  • Actions (Unban / Make Permanent)

Manual IP Banning:

  1. Navigate to IP Management tab.
  2. Enter IP address in "Ban IP" field.
  3. Select ban duration (1 hour, 24 hours, or Permanent).
  4. Provide reason for documentation.
  5. Click Ban IP.

Unbanning Procedures:

  • Click Unban button next to IP address.
  • Confirm action (requires admin confirmation).
  • IP is immediately removed from ban list.

Whitelist Operations

Adding to Whitelist:

  1. Navigate to IP Management → Whitelist tab.
  2. Enter IP address.
  3. Add notes (e.g., "Office IP - Development team").
  4. Click Add to Whitelist.

Removing from Whitelist:

  • Locate IP in whitelist table.
  • Click Remove button.
  • Confirm removal.

⚙️ Configuration Best Practices

  • Small Business Sites: 15 req/min, 50 attempts threshold, 6-hour ban duration.
  • E-commerce/SaaS: 50 req/min, 25 attempts threshold, permanent ban.
  • High-Traffic Sites: Enable Redis caching for ban list lookups.

📈 Operational Best Practices

Daily Monitoring

  • Review CF7 Security → Dashboard for attack trends.
  • Check Attacks (24h) metric for unusual spikes.
  • Verify Protected Forms count is accurate.

Weekly Maintenance

  • Review ban list for false positives.
  • Clear expired bans via IP Management → Clear Expired Bans.
  • Check whitelist for outdated entries.

Monthly Tasks

  • Archive security logs (download JSON files from /wp-content/cf7fc_logs/).
  • Review language validation settings for accuracy.
  • Test forms with known attack payloads to verify protection.

Incident Response

If attack count exceeds 1000 in 24 hours:

  1. Review attack type distribution.
  2. Identify source IPs (check for distributed attack).
  3. Temporarily reduce rate limit if legitimate traffic affected.
  4. Contact hosting provider if server resources strained.

Author: Mikhail Deynekin

Clone this wiki locally