InstaWP Docs

Appearance

Configure Shield ​

Shield is InstaWP's built-in, edge-level security layer for your live sites. It protects your WordPress site with a Web Application Firewall (WAF), DDoS mitigation and Bot Detection — filtering malicious traffic at the CDN edge (powered by Bunny Shield) before it ever reaches your origin server. SSL is issued and renewed automatically as part of the same protection layer.

In this documentation, we will explore:

  1. Plan availability
  2. Where to find Shield
  3. Learning Mode
  4. WAF (Web Application Firewall)
  5. DDoS Configuration
  6. Bot Detection
  7. Downloading logs

Plan availability ​

Shield is included on all paid, public-facing plans — Starter, Plus, Pro, Turbo and Elite. It is not available on the Sandbox plan, which is meant for work-in-progress environments rather than live sites. If Shield is enabled and you want to move a site down to Sandbox, you must disable Shield first — see Downgrade Site Plans. For a full feature comparison, see Site Plans.

Where to find Shield ​

Open the site from your Sites list, then in the site's left-hand menu expand Configuration → Shield. The Shield page groups all three protection layers on one screen, with live counters showing how much traffic each layer has acted on.

Shield settings under Configuration, showing the header, learning-mode banner and the WAF layer

  1. Download Logs — export the raw WAF / DDoS / Bot event log for this site.
  2. Learning Mode — Shield's safe, log-only warm-up period (see below).
  3. Layer toggle — each protection layer has its own on/off switch.

Learning Mode ​

When Shield is first enabled it enters Learning Mode for 7 days. During this window every request that matches a WAF rule is logged but never blocked, so you can review what Shield would have acted on and catch any false positives before enforcement begins — important if your site uses page builders, custom endpoints or automation tools.

If you are confident and want protection enforced immediately, click Exit Learning Mode.

WAF (Web Application Firewall) ​

The WAF protects your site from exploits, SQL injection and other attacks aimed at harming your site. The counters show how many requests the WAF Triggered, Blocked and Logged.

WAF layer showing the on/off toggle and the Log/Block mode selector

  1. WAF on/off — enable or disable the Web Application Firewall for this site.
  2. WAF Mode — Log records rule matches without blocking (ideal while tuning); Block actively denies malicious requests. Start in Log, then switch to Block once you have confirmed there are no false positives.

DDoS Configuration ​

DDoS mitigation absorbs volumetric and challenge-based attacks at the edge. Tune it to match your site's traffic profile. The counters show Challenges Served, Challenges Verified and Logged.

DDoS configuration showing the Valid Challenge Window setting

  1. Valid Challenge Window — how long a visitor stays trusted after passing a DDoS challenge. When it expires they must pass a new one. A shorter window is stricter; a longer window means fewer challenges for legitimate visitors.

Bot Detection ​

Bot Detection identifies and mitigates malicious or unwanted automated traffic. The counters show Bots Challenged, Challenges Verified and Blocked.

Bot Detection showing the mode selector, sensitivity controls and the service allowlist

  1. Bot Detection on/off — master switch for the whole Bot Detection layer.
  2. Bot Detection Mode — Log only records suspected bots; Challenge makes them prove they are human before reaching your site. Use Log first, then Challenge.
  3. Sensitivity controls — Request Integrity, IP Address, Browser Fingerprint and Fingerprint Aggression each tune how aggressively traffic is judged to be a bot (from Low to High). Raise them when you are under bot pressure; lower them if legitimate tools are being challenged.
  4. Service allowlist — bypass Bot Detection for trusted services. Enable Allow ManageWP Access if you manage this site with ManageWP, and Allow ShortPixel Access if you use ShortPixel to optimize images, so those services are never blocked.

Downloading logs ​

Use the Download Logs button at the top of the Shield page to export the event log for this site. Reviewing the log is the best way to confirm that Shield is blocking genuine threats and not legitimate traffic — especially before you exit Learning Mode or switch a layer from Log to Block.

Tip: The safe rollout order for any layer is Log → review the logs → Block. If a legitimate request is ever blocked, drop the affected layer back to Log (or lower its sensitivity) while you investigate.

Docs are open — edit on GitHub. Built with VitePress.

© InstaWP