Check if we are protected

A simple way to verify that the Web Firewall plugin is active and blocking attacks is to submit the classic SQL Injection test string into a field on your site - such as a login form, contact form, or search field:

' or 1=1--

If the firewall is working, you will see a block page or error message:

Block page shown when the Web Firewall detects an attack

A new entry should also appear in Components > SecurityCheck Pro > View Logs:

Firewall log entry for a detected SQL Injection attempt

If no block page appears and no log entry is created, check the following:

  • Confirm the Web Firewall Plugin is enabled. The Dashboard shows its status under Plugin Status Cards.
  • Confirm the plugin (plg_system_securitycheckpro) is enabled in System > Manage > Plugins.
  • Check whether the user group you are testing from is set to Rules Applied: No (trusted) in Rules Management - trusted groups bypass all firewall checks.
  • Confirm that GET, POST, or REQUEST methods are enabled in the Web Firewall Configuration > Methods tab, depending on how the test form submits data.