Multisite with multiple domains

No specific setup, just activate it. Its dashboard will be accessible from the main site only, and it will protect all sites in your network.

In my case it does not work. I also have a multisite, some of the sites are mapped to other domains (via domain mapping). If I run the test from

https://nintechnet.com/ninjafirewall/wp-edition/

it works on the main site/domain. But on sites with other domains, it fails completely:(

Any idea?

Try the troubleshooter script: https://nintechnet.com/share/wp-check.txt

Test it by accessing the main domain, and also a child site.
Then post the results (you can anonymize the paths).

Also, go to “NinjaFirewall > Network” and make sure that the “Display NinjaFirewall status icon in the admin bar of all sites in the network” option is enabled. Then log in to a child site and check if you see NF’s icon in the admin bar.

Thank you for your message!

I activated the status icon and did the text with wp-check.

This is the result, it’s exactly the same result by accessing the main domain and a child site:

HTTP server : Apache
PHP version : 7.1.33-nmm1
PHP SAPI : FPM-FCGI

auto_prepend_file : none
wp-config.php : found in XXX/wp-config.php
NinjaFirewall detection : NinjaFirewall WP Edition is loaded (WordPress WAF mode)

Loaded INI file : /etc/php71/fpm/php.ini
user_ini.filename : .user.ini
user_ini.cache_ttl : 300 seconds
User PHP INI : none found

DOCUMENT_ROOT : /XXX/
ABSPATH : /XXX/
WordPress version : 5.3.2
WP_CONTENT_DIR : /XXX/wp-content
Plugins directory : /XXX/wp-content/plugins
User Role : Administrator
User Capabilities : manage_options: OK – unfiltered_html: OK
Log dir permissions : /XXX/wp-content/nfwlog dir is writable
Cache dir permissions : /XXX/wp-content/nfwlog/cache dir is writable

Log out of WordPress (so that you aren’t whitelisted) and try to trigger the firewall on the main site and any – or all- child site:
https://example.com/?ninjatest=%00

Are you blocked by the firewall?

I tried, the result:

the main site https://example.com/?ninjatest=%00 is blocked

the site https://example.com/subsite1/?ninjatest=%00 is NOT blocked

the site with mapped domain https://otherexample.com/?ninjatest=%00 is NOT blocked

maybe there are other settings I have to activate? we have some rules in our security header, for instance X-XSS-Protection, maybe one of this settings is a reason?

Your setup doesn’t seem to work in “WordPress WAF” mode.
Can you try to enable the “Full WAF” mode from the firewall’s dashboard? During the setup, select “.user.ini” as you are running PHP FPM.

it works! Thank you very much!! ??