Security Exceptions Log
Prev Web Application Firewall Next

Security Exceptions Log

The Security Exceptions Log viewer page

A firewall is worth nothing if it can't log the attempts to override it. Most usually you will see that the same kind of attacks are coming from the same IP addresses over and over again. Using this log viewer facility you can dive into the log, spot those IPs and note them down so that you can ban them (put them in the Blacklist).

Below each IP there is a link reading Add to Black List or Remove from Black List. Clicking the former will add the IP address of the relevant record to the IP Black List and that IP will be denied access to your site. The latter removes the IP address from the black list.

[Note]Note

If you want to unblock someone who got their IP inadvertently blocked you will have to remove all records belonging to their IP address in FOUR (4) places: Site IP blacklist, Security Exceptions Log, Auto IP Blocking Administration and Auto IP Blocking History.

List of blocking reasons

The block reasons, listed in the log and optionally sent to you by email are the following. The "Code" is what you need to enter in the "Do not log these reasons" or "Do not send email notifications for these reasons" options in WAF configuration to prevent these security exceptions from being logged or trigger an email respectively.

Admin Query String

Code: ipwl

Someone tried to access your site's administrator section but he didn't provide the secret URL parameter. Admin Tools blocked him and prevented him from seeing the login page at all.

Admin IP Whitelist

Code: adminpw

Someone tried to access your site's administrator section but his IP was not in the Administrator IP Whitelist. Admin Tools blocked him and prevented him from seeing the login page at all.

Site IP Blacklist

Code: not applicable

Someone tried accessing the front- or back-end of your site but his IP is in the IP Blacklist. Admin Tools blocked him and didn't allow him to see the content of your site.

SQLi Shield

Code: sqlishield

See the Configure WAF page, SQLiShield protection against SQL injection attacks. The attack was blocked by Admin Tools.

Bad Words Filtering

Code: antispam

The request contains one of the Bad Words you have defined and was blocked by Admin Tools.

RFIShield

Code: rfishield

See the Configure WAF page, Remote File Inclusion block (RFIShield). The attack was blocked by Admin Tools.

DFIShield

Code: dfishield

See the Configure WAF page, Direct File Inclusion shield (DFIShield). The attack was blocked by Admin Tools.

UploadShield

Code: uploadshield

See the Configure WAF page, Uploads scanner (UploadShield). The attack was blocked by Admin Tools.

Spammer (via HTTP:BL)

Code: httpbl

See the Configure WAF page, Project HoneyPot. The attack was blocked by Admin Tools.

Login failure

Code: loginfailure

Someone tried to log in in the front- or back-end of your site with the wrong username and/or password.

Admin Directory

Code: admindir

See the Configure WAF page, Change admin URL. The request was blocked by Admin Tools.

Edit Admin User

Code: nonewadmins

Someone tried to create or edit an administrator user from the backend of your site. In this context "administrator user" means any user who has the "administrator" role or has the capacity to activate plugins.

PHPShield

Code: phpshield

See the Configure WAF page, Remote PHP protocol block. The request was blocked by Admin Tools.

Prev Up Next
Anti-spam Bad Words Home Auto IP Blocking Administration