"wp-content" is hard-coded in the code

Do you mean that you changed WP_CONTENT_DIR while NinjaFirewall was already installed ?
If you did so, then you need to modify the full path to the firewall.php file in your PHP ini file. Or delete the lines from PHP ini and .htaccess, uninstall and re-install it all.
Otherwise, there is no problem to install it if you have a different WP_CONTENT_DIR, because the installer relies on the WP plugin_dir_path() function which will return the correct path.
The ‘wp-content’ hard-coded string affects only some rules from the “Firewall > Policies” menu (that was fixed in the 1.1.2 version that will be released later this week) but does not affect the installation or the firewall.

Thank you for you answer, i did removed the plugin and reinstall it again, and it did work for me now. (I think i forgot to restart apache)

but still some of the code dose mention wp-content as fixed string


grep -n wp-content *

ninjafirewall.php:1833: $tmp .= '/wp-content/uploads/|';
ninjafirewall.php:1848: $nfw_options['no_post_themes'] = '/wp-content/themes/';
ninjafirewall.php:1996: '/wp-content/uploads/|/cache/';

The wp-content strings were removed in the next version 1.1.2. This new update will be available later this week.

Thank you for your help