Experience with NAXSI?

theroyalstudent

Does anyone here have experience with NAXSI? Would like to implement a WAF into my friend's machine over at DigitalOcean SG as soon as possible, as he keeps getting hacked, and having "Hacked By HaYaL-ET-06" left on the website when accessed with a desktop.

It's been a while since he got hacked already (5 websites on same node, down at once), and I've done full restores from our shared Amazon Cloud Drive account for all of them, though it's not preferred, since our database dump is 300MB large (20-30 sites [50% PBN], all databases username & password are the same for easy setup).

So back to the topic, does anyone here use NAXSI, or should I consider an alternative?

I'm not asking for much out of a WAF, just a custom landing page when a request is blocked, that's all

Thanks for reading!

//ed

howardsl2

I wrote up a tutorial for Ghost blog w/ Naxsi some time ago. Check my auto setup script on GitHub for helpful hints on Naxsi setup.

Also read the official Naxsi wiki and how to create whitelists.