Installation Guide

Get the code

Download the addon file - there's a link displayed at the end of checkout and it's available in your account on this site under My Products as well as in the order view.

Unzip and copy the contents of catalog to your store taking account of the name of your admin folder.

If you have a slow FTP connection, leave the hooks (catalog/include/hooks) until last to avoid making the site temporarily inaccessible.

Pre-installation Checks

Navigate to Admin > Configuration > Phoenix Firewall and you're on the firewall's Support/Diagnose page. Check through the pre-installation manual report in case of any server configuration issues which will be reported here.

If there are no show-stoppers, hit the Install Now button (it was at the top of the page and you already did that, didn't you?)

All being well, you get a green box and a Click Here to Get Started.

Settings and Manual Steps

You're now back at the Support/Diagnose page. There's a lot more here and there are some actions that you will need to take now.

1. Firewall Configure: this will be showing an error that the config is missing and the firewall won't work until it's generated. This is because the firewall works from its own configure.php with different variable names so that it can run outside Phoenix. If you ever manage to lock yourself out or render the site inaccessible, you can disable the firewall by deleting the file (includes/apps/firewall/configure.php). Once the issue is sorted, come back here and regenerate the file. The addon also keeps a copy of its settings in another file so it can work without the database; that one is maintained automatically when you change settings.
2. To enable the access scanner to check non-php files before a visitor's browser downloads them, manually copy the displayed code to the .htaccess file in your shop's root. If you can't see one, check that your file manager is set to display dot files.
3. For effective hack protection, you need to run an auto_prepend_file. This invokes the access scanner on all website requests, irrespective of the file requested. This means it will get run on files that a hacker has uploaded to your server. Exactly how this is to be configured depends on how your hosting is set up, so there are several different approaches outlined. Try them one at a time until it works - undo the previous attempt before continuing to the next method.

Now go through the settings (top right) and familiarise yourself with the capabilities.  Notes on the settings are in the User Guide.