In reply to Rob.

Classic case of believing something someone told you (or a pretty graphic) and not really verifying the information as fact. .htaccess files are processed first before PHP code since htaccess files are distributed server configuration files. Then the Ninja plugins claims are false. I don't think this is intentional. I think they honestly believe their WAF is processed first which is incorrect/not valid.