---
title: "How to Setup BBQ: Block Bad Queries on WordPress"
description: "BBQ: Block Bad Queries is a small WordPress security plugin that does one thing: block malicious requests. The plug-and-play plugin fights SQL injections, file execution attempts, and more. For..."
url: https://www.inmotionhosting.com/support/edu/wordpress/how-to-setup-bbq-block-bad-queries-on-wordpress/
date: 2019-08-27
modified: 2023-03-15
author: "InMotion Hosting Contributor"
categories: ["WordPress Hosting", "WordPress Tutorials"]
type: post
lang: en
---

# How to Setup BBQ: Block Bad Queries on WordPress

[BBQ: Block Bad Queries](https://wordpress.org/plugins/block-bad-queries/) is a small WordPress security plugin that does one thing: *block malicious requests*. The plug-and-play plugin fights SQL injections, file execution attempts, and more.

For example, BBQ scans URL requests for queries searching for executable .exe files, archived .tar compression packages, hidden files with sensitive information, and bash commands such as `makefile`.

BBQ does this without modifying your .htaccess file, database tables, or production workflow in any way. It simply scans URL requests and blocks them when matching patterns are found.

Note: BBQ is designed and expected to work alongside other major WordPress security plugins. We recommend [WP Cerber Security](https://wpcerber.com/) or [Wordfence Security](https://www.inmotionhosting.com/support/edu/wordpress/plugins/wordfence/).

Below we’ll **enable BBQ: Block Bad Queries**.

## Set Up BBQ: Block Bad Queries

This is a plug-and-play plugin. You can easily [install the plugin manually](/support/website/how-to-upload-files-server/) or via [WP-](/support/edu/wordpress/wp-cli/install-a-plugin-using-wp-cli/)[CLI](/support/edu/wordpress/wp-cli/install-a-plugin-using-wp-cli/) (plugin name `block-bad-queries`). Below we’ll use the WordPress dashboard.

1. [Log in to WordPress](/support/edu/wordpress/logging-into-wordpress-dashboard/).
2. Install the BBQ: Block Bad Queries plugin.
3. **Activate** the plugin.
4. That’s it! Click **Settings** under Block Bad Queries (BBQ) for a link to its respective WordPress.org page, BBQ Version, and link to the [Pro version](https://plugin-planet.com/bbq-pro/). You can also view this page under the *Settings* section on the left.

The Pro version includes more features such as redirect URLs, URL request statistics, and more.

If your security scanner – e.g. [ClamAV](/support/edu/cpanel/install-and-configure-clamav/) or [Sucuri](/support/security/what-is-sucuri/) – reports malware while BBQ is installed, it may have simply found BBQ’s blacklist. Please [contact our 24/7 Technical Support](/support/amp/how-to-get-great-technical-support/) for further assistance.

Are you learning more about WordPress security? Read more about WordPress and general web security with the following articles:

- [10 Ways to Secure WordPress](/support/edu/wordpress/10-ways-to-secure-wordpress/) with plugins, best security practices, and other configurations
- [Check out Sucuri](https://sucuri.net/website-security-platform/signup/) web application firewall (WAF) for improved security and performance
- VPS Hosting offers server-level security features via [WebHost Manager (WHM)](/support/edu/whm/log-into-whm/) unavailable to Business Hosting customers:
  - [cPHulk Brute Force Login Protection](/support/edu/whm/enable-cphulk-brute-force-protection/)
  - [ClamAV cPanel Account Scanner](/support/edu/cpanel/install-and-configure-clamav/)
  - [And more](/support/product-guides/vps-hosting/)