8G Helper

8G is the successor to Jeff Starr’s 7G firewall, and he publishes it for Apache only. GridPane has no 8G switch: its 7G toggle is GridPane’s own build of 7G. On GridPane’s nginx you run nG-SetEnvIf, the nginx version of 8G, by hand, one site at a time.

It also blocks things you want: Ahrefs, uptime monitors and anything else that sends curl’s name, site searches with words like get or select, and the localhost address AI tools send when they sign in. The log names a rule group and a number, such as bot=3, and the pattern behind it is one of 118 regular expressions. Switch 8G straight on, and the first sign of a false positive is a 403 for someone you wanted.

8G Helper reads the log line for you. Paste a line from the 8G log, in watch or enforce mode, or from any nginx or Apache access log. It names the rule group and number, shows the exact pattern and its line in 8g-firewall.conf, marks the text that matched, lists any other rule in the group that matches too, and gives a first opinion: an attack, a likely false positive, or a crawler you may want. On a test harness of 118 requests, its matcher agrees with real nginx every time.

For a request you want, “Allow it for now” gives nG’s documented fix, not a scoped exception: take the matched word out of the rule, or comment the rule out, in every copy on the server, because nginx keeps one set of 8G rules per server. It lists the copies first, then writes the edit with backups, an nginx -t check that restores them if it fails, and an undo. Scoped exceptions wait until enforce mode has been tested on staging, and an Apache version comes next.

The second half of the page moves a GridPane site from 7G to 8G: check the server, download the rules, run 8G in watch mode beside 7G, check it, read the log for a week or two, then enforce on staging first. The commands come unchanged from my runbook, which ran on a mock of GridPane’s setup and then, in watch mode, on seven live sites across five servers: each logged a test request as bot=3 and kept serving as before. Enforce mode has not run on a live server yet. Nothing you paste leaves the browser, and there is no account.