I built a 7G firewall exception generator for GridPane

7G Helper is a free tool for anyone running WordPress on GridPane with the 7G firewall turned on. You paste a line from the site's 7G log, and it shows which rule blocked the request and what part of the request set it off. Then it writes an exception file that lets that one kind of request through and keeps every other rule on. It runs in your browser, with no account.

I built it because I've needed it for a while. I have just over 50 GridPane sites across 10 servers, and every so often 7G blocks something I actually want.

What is 7G, and why does it block good requests?

7G is Jeff Starr's firewall, a long list of patterns for requests that look like attacks or junk: odd user agents, scanner paths, query strings that try to sneak a URL or a script into the site. GridPane ships it for nginx, split into five rule groups. Each group reads one part of the request: the user agent, the referrer, the query string, the address and the request method.

Patterns that broad catch real traffic too. Rule 15 in the address group blocks any request with https:// in it, which stops a lot of probing. It also stops Rank Math's SEO preview, because that request carries your own site's address. When 7G blocks something, the site answers 403 and the only clue is a line in /var/www/<site>/logs/7g.log.

How did I fix these before?

The first legitimate request I saw 7G block on one of my own sites was Fluent Forms. I was setting up Slack notifications for failed form submissions, the setup kept failing, and it turned out 7G was blocking it.

My first fix was to switch off the rule that was doing it. That worked, and it's also the wrong fix, because it lowers the guard for every request to get one through. So I learned to write exception files instead. GridPane keeps a place for them that survives its updates, and an exception can switch off one rule for one kind of request.

Every one was tedious. I'd open GridPane's documentation, check the syntax, work out which variable the rule set, and sometimes ask in the community forum for help. That was before AI assistants were as common as they are now. Today a savvy user could get there with their own agent, and some won't need this tool at all.

What does 7G Helper do?

Paste the log line. 7G Helper reads the request, matches it against the same rule set GridPane ships, and shows the rule group, the rule number and the text that matched. Then it writes the exception file, tells you where to save it (one site or the whole server), and gives you the commands to check the config, reload nginx, and prove it worked. One test request should now pass, and a second should still come back 403, which shows the rest of the firewall is still on.

Here is the file it writes for that Rank Math request:

# Save as: /var/www/example.com/nginx/allow-rankmath-v1-gethead-7g-context.conf
set $allow7g_rankmath_v1_gethead_bad_request_15 "";
if ($request_uri ~ "^/wp-json/rankmath/v1/getHead(\?|$)") {
    set $allow7g_rankmath_v1_gethead_bad_request_15 15;
}
if ($bad_request_7g = $allow7g_rankmath_v1_gethead_bad_request_15) {
    set $7g_drop_bad_request 0;
}

It only lets the request through when rule 15 is what blocked it and the address is Rank Math's. Every other rule still applies to that request, and rule 15 still applies to everything else. Then, on the server:

nginx -t && gp ngx reload
curl -s -o /dev/null -w '%{http_code}\n' 'https://example.com/wp-json/rankmath/v1/getHead?url=https://example.com'
curl -s -o /dev/null -w '%{http_code}\n' 'https://example.com/.env'

The first curl should print anything but 403. The second should print 403.

What happened when Facebook couldn't preview a site?

While I was finishing the tool, links to Prosper Project stopped showing previews on Facebook. The 7G log had the answer: bad_bot_6, with facebookexternalhit as the user agent. That's the crawler Facebook uses to fetch a page's title and image.

7G Helper said something I hadn't planned for: rule 6 isn't one of GridPane's. None of GridPane's own user-agent rules is numbered 6. This one came from a list on that server blocking four crawlers on one line: GPTBot, Meta's AI crawler, FacebookBot, and facebookexternalhit. An exception file would have worked, but the cleaner fix was to take one name off that line and leave the other three blocked.

Getting there taught me a few things the documentation doesn't cover, and each one is now part of the tool:

• Find the exact file first. My first edit used a wildcard that matched two files, GridPane's own and the custom one, so it quietly changed nothing. 7G Helper now prints every matching line with its file name before you edit anything.
• Never leave an empty list. If the crawler is the only name on a line, deleting the name leaves ~*(), which matches every request. The tool deletes the whole line instead.
• Run it on the server. At one point the commands went into a terminal on my Mac, not the server. The steps now say where each command runs.

After the edit and a reload, the test request came back 200 and Facebook could read the page again.

Why build it by hand?

7G Helper was meant to be the first app built by Fire for Effect, a workflow I've been building to take an app from a written brief to launch mostly unattended, stopping only for the keys an agent can't get. After ten runs, no run had made it past the third milestone. Nearly every stop was a gap in the workflow itself rather than in the app: a token missing one permission, or a check that couldn't be made to fail on purpose.

On October 21 I stopped and built version 1 with Claude Code in a day, working alongside it instead of leaving it to run. It's a static page: no database and no sign-in. The tests run on real log lines from my own servers, and the server edit is tested with the Linux version of sed, because the one on a Mac behaves differently.

What's next?

A public library of approved exceptions is on the roadmap: fixes other people have confirmed for common plugins and services. I have no plans to build it soon. It depends on whether people use the tool and ask for it.

What's worth keeping?

Turning a firewall rule off is the fast fix and the wrong one. A scoped exception takes a few more minutes, and 7G Helper shrinks those minutes to a paste. If you'd rather follow a set of steps on a page than talk an agent through GridPane's documentation, it should get you there faster. It also covers the cases the documentation hasn't caught up with.

Stack: React 19 and TypeScript on Vite, prerendered, on Cloudflare Pages. GridPane's 7G rule set (version 1.4) is read in the browser. Unit tests run on real log lines, and Playwright tests run against the live site.