- This topic has 87 replies, 22 voices, and was last updated 1 year ago by
.
-
Event Codes:BFHS: Blocked/Forbidden Hacker or Spammer (approximately 99.99% of all log entries will have this Event Code)
HPRA: Hacker Probe/Recon/Attack
PSBR: Plugin Skip/Bypass Rule if something legitimate is being blocked.
WPADMIN-SBR: wp-admin Skip/Bypass Rule if something legitimate is being blocked.
HEAD: HEAD Request Blocked – Either a spambot or something legitimate making a HEAD Request (See Event Code: HEAD solution)
PFWR: Plugin Firewall Whitelist Rule (BPS Pro only). Plugin Firewall AutoPilot Mode creates whitelist rules automatically.
UAEGWR: Uploads Anti-Exploit Guard Whitelist Rule (BPS Pro only) if something legitimate is being blocked.Examples Logged Fields/Scenarios:
Event Code: PFWR-PSBR-HPR (3 relevant fields to check & 3 possible causes)
Event Code: PFWR-PSBR-HPR SERVER_PROTOCOL: HTTP/1.1 REQUEST_URI: /wp-content/plugins/xyz-plugin/js/xyz-plugin-script.js HTTP_USER_AGENT: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; InfoPath.1; SV1; .NET CLR 3.8.36217; WOW64; en-US)
The Event Code indicates this could either be a random hacker recon/probe or Plugin Skip/Bypass rule that needs to be created or a Plugin Firewall whitelist rule (BPS Pro only) that needs to be created.
Solution: If the plugin is actually installed/exists & the Server Protocol is HTTP/1.1 and not HTTP/1.0 and the User Agent is not blank/empty then either a Plugin Skip/Bypass rule needs to be created or a Plugin Firewall whitelist rule (BPS Pro only) needs to be created. If the Server Protocol is HTTP/1.0 or the User Agent is blank then the odds are very high that this is a random hacker recon/probe. If the plugin is NOT actually installed on the website then this is a 100% confirmed random hacker recon/probe. Searching the Forum will produce any documented solutions for Plugin Skip/Bypass rules by searching using the plugin’s name as the search word/term. For Plugin Firewall whitelist rules see this Forum Topic link: https://forum.ait-pro.com/forums/topic/plugin-firewall-read-me-first-troubleshooting/
Event Code: WPADMIN-SBR (2 relevant fields to check – only 1 possible cause and solution)
Event Code: WPADMIN-SBR HTTP_REFERER: http://[domain name removed for privacy]/wp-admin/post.php?post=287&action=edit REQUEST_URI: /wp-content/plugins/sublimevideo-official/tinymce/sv-insert.php?%27webkitAllowFullScreen=%271 HTTP_REFERER: http://[domain name removed for privacy]/2014/01/02/fallouts-classic-catalogue-removed-from-gog-due-to-rights-issue/ REQUEST_URI: /blog/wp-admin/curate-this.php?u=http%3A%5C%2F%5C%2F[domain name removed for privacy]%5C%2F2014%5C%2F01%5C%2F02%5C%2Ffallouts-classic-catalogue-removed-from-gog-due-to-rights-issue%5C%2F&t=Fallout%27s%20classic%20catalogue%20removed%20from%20GOG%20due%20to%20rights%20issue%20%7C%20PC%20Gamer&s=&v=4 HTTP_REFERER: http://[domain name removed for privacy]/wp-admin/admin.php?page=formidable-settings REQUEST_URI: /wp-admin/index.php?plugin=formidable&controller=settings&frm_action=process-form&action=process-form&_wpnonce=6b6ef1c65d
Solution: There are 2 relevant fields to check for Event Code: WPADMIN-SBR.. The HTTP_REFERER and REQUEST_URI logging fields. If the Referer or Request URI has /wp-admin/ in the path then these are things that are being blocked by BPS in the wp-admin .htaccess file and a Skip/Bypass rule needs to be created for the wp-admin .htaccess file by adding it to BPS Custom Code. Typically either a wp-admin file needs to be whitelisted in the Skip/Bypass rule or a Query String needs to be whitelisted. Searching the Forum will produce any documented solutions for wp-admin Skip/Bypass rules by searching using the plugin’s name as the search word/term.
Event Code: UAEGWR-HPR (1 relevant field to check – 2 possible causes)
Event Code: UAEGWR-HPR REQUEST_URI: /wp-content/uploads/avada.js
Solution: There is 1 relevant field to check for Event Code: UAEGWR-HPR. The REQUEST_URI logging field. Either a plugin or theme is storing and calling/requesting a .js, .swf or other file type from the WordPress /uploads folder and it is being blocked by BPS or this is a random hacker probe/recon. If the file shown in the Request URI does not actually exist on the website then this is a 100% confirmed random hacker probe/recon. For UAEG whitelist rules see this Forum Topic link: https://forum.ait-pro.com/forums/topic/uploads-anti-exploit-guard-uaeg-read-me-first/
Event Code: HEAD (3 relevant fields to check – 2 possible scenarios)
Event Code: BFHS-HEAD - HEAD Request Blocked HTTP_REFERER: REQUEST_URI: /?author=3 HTTP_USER_AGENT: curl/7.35.0
Solution: Either a spambot or other bad bot is making a HEAD Request on your website and it was blocked or something legitimate like a plugin or theme is making HEAD Requests for things like image retrieval or other tasks. To Allow/not block ALL HEAD Requests do the steps below:
1. Copy this modified REQUEST METHODS FILTERED .htaccess code below to this BPS Custom Code text box CUSTOM CODE REQUEST METHODS FILTERED: Whitelist User Agents or remove HEAD here
2. Click the Save Root Custom Code button.
3. Go to the BPS Security Modes page and click the Root Folder BulletProof Mode Activate button.BPS Pro 11.6+ & BPS free .53.2+
You may see this code or the 11.5+/.53.1+ code in your root htaccess file. The code does the same exact thing and is whitelisted in the same exact way.# REQUEST METHODS FILTERED # If you want to allow HEAD Requests use BPS Custom Code and copy # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code # text box: CUSTOM CODE REQUEST METHODS FILTERED. # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps. RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC] RewriteRule ^(.*)$ - [F] #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC] #RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]BPS Pro 11.5+ and BPS .53.1+
# REQUEST METHODS FILTERED # If you want to allow HEAD Requests use BPS Custom Code and copy # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code # text box: CUSTOM CODE REQUEST METHODS FILTERED. # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps. RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC] RewriteRule ^(.*)$ - [F] #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC] #RewriteRule ^(.*)$ - [R=405,L]If you are using an older BPS plugin version or older BPS root htaccess code then use this code instead or upgrade to a newer version of BPS.
# REQUEST METHODS FILTERED # If you want to allow HEAD Requests use BPS Custom Code and # remove/delete HEAD| from the Request Method filter. # Example: RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC] # The TRACE, DELETE, TRACK and DEBUG Request methods should never be removed. RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC] RewriteRule ^(.*)$ - [F]
- You must be logged in to reply to this topic.