BulletProof Security Forum

Hmm, well I just had a look at Google webmaster tools and the 404 error for /support/ is valid as no page existed at the time but there was a link to it in the footer. The /sitemmap.xml is also valid as that’s a typo (two m’s), I think that was a SEO submission from a cpanel tool (Attracta) which was my mistake. So, I’m left with /new-slider/ which is probably due to an old plugin but I’ll keep an eye on that to see if it turns up again in the logs.

The round bracket code characters ( and ) are being blocked in the Query String.  See this forum topic link below for the solution to whitelist this by adding modified BPS Query String Exploits code to BPS Custom Code and saving that code permanently.
http://forum.ait-pro.com/forums/topic/mailchimp-tracking-code-causing-403/#post-13778

Yes.  BPS and BPS Pro are coded to work with WP 4.0, 4.0.1 and WP 4.1, which will be released in a couple to a few weeks.  The BPS Custom Code steps are universal and the basic concept and usage will never change.  BPS htaccess Security filters/code may change in the future and each/every forum topic that has older code is updated with newer code if/when new code/filters are created.  BPS also automatically updates htaccess files/code/filters during BPS upgrades, but does change or alter any Custom Code that you have added.

Yes, do all of the Custom Code setup steps and no the wp-admin BulletProof message is just a reminder so you can do that additional step, but it is not necessary to do that additional step.  The steps are also listed in the Read Me help button on the Custom Code page or you can click the Custom Code video tutorial link to see what to do visually.

Hi,

I receive this error after I click “Save” ….
“****mysite****.com 403 Forbidden Error Page
If you arrived here due to a search or clicking on a link click your Browser’s back button to return to the previous page. Thank you.
IP Address: 93.**.***.213”
What is that? … Thank you! 🙂

Should I be worried? do something?

BPS SECURITY LOG
=================
=================

[403 GET / HEAD Request: 9 januari 2015 - 14:40]
Event Code: WPADMIN-SBR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 92.63.87.11
Host Name: ip87-11.mwtv.lv
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 Safari/534.30

[403 GET / HEAD Request: 9 januari 2015 - 14:40]
Event Code: WPADMIN-SBR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 92.63.87.11
Host Name: ip87-11.mwtv.lv
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /wp-admin/admin-ajax.php?action=getfile&/../../wp-config.php
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (X11; CrOS i686 1660.57.0) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.46 Safari/535.19

[403 GET / HEAD Request: 9 januari 2015 - 14:40]
Event Code: PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 92.63.87.11
Host Name: ip87-11.mwtv.lv
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /$wp-content$/plugins/wp-filemanager/incl/libfile.php?&path=../../&filename=wp-config.php&action=download
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.43 Safari/534.24

[403 GET / HEAD Request: 9 januari 2015 - 14:40]
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: 92.63.87.11
Host Name: ip87-11.mwtv.lv
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /$wp-content$/themes/parallelus-mingle/framework/utilities/download/getfile.php?file=../../../../../../wp-config.php
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.113 Safari/534.30

[403 GET / HEAD Request: 9 januari 2015 - 14:40]
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: 92.63.87.11
Host Name: ip87-11.mwtv.lv
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /$wp-content$/themes/parallelus-salutation/framework/utilities/download/getfile.php?file=../../../../../../wp-config.php
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.65 Safari/535.11

[Topic has been merged into this relevant Topic]

Howdy,

New BPS Free user here.

As per the title, BPS is doing a fine job of sending the security logs from this hosting account where there was previously a Joomla! 1.5.x install that was compromised. Sucuri did the site clean up and successfully removed the malware and has submitted the request to SiteAdvisor  to remove the Blacklisting. I installed the latest WP 4.1 (now updated to 4.1.1) and the latest BPS Free and rebuilt the site. All seemed well until I started receiving the numerous security logs. Checking the hosting account (shared Linux at Go Daddy), I noticed the resources being heavily used (for the low traffic volume this site gets) and the Access Logs were relatively ‘huge’. My question is, is there anything I can set in BPS to stop these requests or is this something that has to be accomplished by another means.

Here is one of many entries from one of the most recent the BPS Security Logs:

[403 GET / HEAD Request: February 19, 2015 - 8:28 pm]
Event Code: PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 178.32.58.65
Host Name: 178.32.58.65
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /plugins/system/plugin_googlemap2/plugin_googlemap2_proxy.php?url=www.soapboxrotations.com
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0

Cheers!
Lyle