Document WordPress WAF (virtual patching)

Add end-user and admin documentation for the WordPress-plugin WAF
(per-site virtual patching against known CVEs):

- wordpress_plugin: new "Web Application Firewall (Virtual Patching)"
  section (how it works, Enabled vs Monitoring, dashboard-widget WAF
  row, CMS WAF tab, enabling/disabling), a version note, and [[toc]];
  screenshots for the widget states, CMS WAF incidents, and the
  disable-rule modal.
- dashboard: "Enable WordPress WAF" and "Enable WAF for new accounts
  by default" settings, the enablement model, and a settings screenshot.
- config_file_description: new WORDPRESS section (security_plugin_enabled,
  waf_enabled, waf_default).
- command_line_interface: new wordpress-plugin section (waf set,
  rules disable/enable/list-disabled).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Martin Krcho

docs/.vuepress/public/images/wordpress-plugin/cms-waf-disable-rule-modal.png

@@ -2695,3 +2695,130 @@ imunify360-agent whitelisted-crawlers [command]
 
    </div>
 
+## WordPress plugin
+
+This command manages the <span class="notranslate">Imunify Security</span> WordPress plugin and its Web Application Firewall (WAF). It is available in both <span class="notranslate">Imunify360</span> (using <span class="notranslate">`imunify360-agent`</span>) and <span class="notranslate">ImunifyAV/AV+</span> (using <span class="notranslate">`imunify-antivirus`</span>).
+
+**Usage:**
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin [command] [subcommand] [--option] <value>
+```
+
+</div>
+
+### Enable or disable the WAF for accounts
+
+Use <span class="notranslate">`waf set`</span> to enable or disable the WordPress WAF for hosting accounts in bulk. The plugin must be installed first (see <span class="notranslate">`security_plugin_enabled`</span> below); otherwise the command reports <span class="notranslate">_WordPress Security Plugin is disabled. Enable it before changing WAF settings._</span>
+
+| | |
+|-|-|
+|<span class="notranslate">`--status`</span>|<span class="notranslate">`enabled`</span> or <span class="notranslate">`disabled`</span>.|
+|<span class="notranslate">`--all-users`</span>|apply to all hosting accounts.|
+|<span class="notranslate">`--users`</span>|apply to a space-separated list of accounts. Use either <span class="notranslate">`--all-users`</span> or <span class="notranslate">`--users`</span>, not both.|
+
+**Examples**
+
+1. Enable the WAF for all hosting accounts:
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin waf set --status enabled --all-users
+```
+
+</div>
+
+2. Disable the WAF for specific accounts:
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin waf set --status disabled --users user1 user2
+```
+
+</div>
+
+The command reports how many accounts succeeded, were skipped (for example, when a name is not a hosting user), or failed.
+
+To change the WAF for a single account, you can also update its configuration directly:
+
+<div class="notranslate">
+
+```
+imunify360-agent config update --user user1 '{"WORDPRESS":{"waf_enabled": false}}'
+```
+
+</div>
+
+Server-wide options — installing the plugin, the server-wide WAF switch, and the default for new accounts — are set without a user:
+
+<div class="notranslate">
+
+```
+imunify360-agent config update '{"WORDPRESS":{"security_plugin_enabled": true}}'
+imunify360-agent config update '{"WORDPRESS":{"waf_enabled": true}}'
+imunify360-agent config update '{"WORDPRESS":{"waf_default": true}}'
+```
+
+</div>
+
+### Manage individual WAF rules
+
+Use the <span class="notranslate">`rules`</span> subcommand to disable or re-enable a specific WAF rule — for example, one that interferes with legitimate traffic. The rule identifier is the one shown for the incident (typically a CVE ID).
+
+| | |
+|-|-|
+|<span class="notranslate">`disable`</span>|disable a rule, for all domains or for specific ones.|
+|<span class="notranslate">`enable`</span>|re-enable a previously disabled rule.|
+|<span class="notranslate">`list-disabled`</span>|list the currently disabled rules.|
+
+| | |
+|-|-|
+|<span class="notranslate">`--rule`</span>|the rule identifier (for example, <span class="notranslate">`CVE-2025-001`</span>).|
+|<span class="notranslate">`--domains`</span>|optional space-separated list of domains. If omitted, the rule is disabled or enabled for all domains.|
+
+**Examples**
+
+1. Disable a rule for all domains:
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin rules disable --rule CVE-2025-001
+```
+
+</div>
+
+2. Disable a rule for specific domains only:
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin rules disable --rule CVE-2025-001 --domains example.com blog.example.com
+```
+
+</div>
+
+3. Re-enable a rule:
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin rules enable --rule CVE-2025-001
+```
+
+</div>
+
+4. List disabled rules:
+
+<div class="notranslate">
+
+```
+imunify360-agent wordpress-plugin rules list-disabled
+```
+
+</div>
+

docs/.vuepress/public/images/wordpress-plugin/cms-waf-disabled-rules.png

@@ -420,6 +420,13 @@ If a non-eligible interval is configured, the agent will ignore it and keep the
 <tr><th colspan="2" align="left"><span class="notranslate">MALWARE_DATABASE_SCAN:</span></th></tr>
 <tr><td><span class="notranslate">enable: True</span></td>
 <td># enable (<span class="notranslate">True</span>) the Malware Database Scanner - a database antivirus with automated malware detection and clean-up of web applications. Requires MariaDB/MySQL DB management system version 5.5. Recommended version is 5.6+. Note, that only WordPress, Joomla, and Magento databases are supported now.</td></tr>
+<tr><th colspan="2" align="left"><span class="notranslate">WORDPRESS:</span></th></tr>
+<tr><td><span class="notranslate">security_plugin_enabled: False</span></td>
+<td># installs the <span class="notranslate">Imunify Security</span> WordPress plugin on all WordPress sites. This is the master switch for the WordPress plugin and its WordPress WAF. Default is <span class="notranslate">False</span>.</td></tr>
+<tr><td><span class="notranslate">waf_enabled: True</span></td>
+<td># enables the WordPress WAF (virtual patching) for WordPress sites on the server. When set to <span class="notranslate">False</span>, WAF rules are removed from all sites. Can also be set per hosting account. Default is <span class="notranslate">True</span>.</td></tr>
+<tr><td><span class="notranslate">waf_default: False</span></td>
+<td># whether the WordPress WAF is enabled automatically for newly created hosting accounts. Default is <span class="notranslate">False</span>.</td></tr>
 </tbody>
 </table>
 

docs/.vuepress/public/images/wordpress-plugin/cms-waf-incidents.png

@@ -1580,8 +1580,6 @@ The WordPress plugin installation is currently allowed only if _Settings > Malwa
 
 Tick the <span class="notranslate">_Install WordPress plugin_</span> checkbox to install the Imunify Security WP plugin on all WordPress sites.
 
-![](/images/wordpress-plugin/panel-settings.png)
-
 You can also enable it via CLI with the following command:
 
 <div class="notranslate">
@@ -1591,6 +1589,30 @@ imunify360-agent config update '{"WORDPRESS":{"security_plugin_enabled": true}}'
 ```
 </div>
 
+Once the plugin is installed, the **WordPress WAF** provides virtual patching against known vulnerabilities in WordPress plugins, themes, and core. For what it protects against and how end users review incidents, see <span class="notranslate">[Web Application Firewall](/wordpress_plugin/#web-application-firewall-virtual-patching)</span>.
+
+Tick the <span class="notranslate">_Enable WordPress WAF_</span> checkbox to turn the WAF on for WordPress sites on this server. When it is disabled, WAF rules are removed from all sites and the <span class="notranslate">_CMS WAF_</span> tab is hidden. This option can also be set per hosting account.
+
+Tick the <span class="notranslate">_Enable WAF for new accounts by default_</span> checkbox to automatically enable the WAF for newly created hosting accounts.
+
+<img src="/images/wordpress-plugin/waf-panel-settings.png" alt="WordPress plugin settings in the control panel: Install WordPress plugin, Enable WordPress WAF, and Enable WAF for new accounts by default" width="520">
+
+:::tip Note
+The WAF is enabled by default for hosting accounts that already existed when it was first rolled out. Newly created accounts follow the <span class="notranslate">_Enable WAF for new accounts by default_</span> setting. A hosting-account owner may disable the WAF for their own account unless it is locked server-wide by the administrator.
+:::
+
+You can also control the WAF via CLI:
+
+<div class="notranslate">
+
+```
+imunify360-agent config update '{"WORDPRESS":{"waf_enabled": true}}'
+imunify360-agent config update '{"WORDPRESS":{"waf_default": true}}'
+```
+</div>
+
+For per-account and bulk control, see <span class="notranslate">[WordPress plugin CLI commands](/command_line_interface/#wordpress-plugin)</span>.
+
 #### Error Reporting
  
 Tick <span class="notranslate">_Enable Sentry error reporting_</span> checkbox to send reports to the Imunify360 error reports server.