Support

You had asked us how to completely block the password reminder pages of Joomla. We told you how to do that. Here's the thing: if you have not removed these links from your login modules on your site then the search engines may see and follow them (depending on whether you're using rel="nofollow,noindex" on those links). However, if search engines did trigger WAF you'd see them in the security exceptions log. You don't see anything like that, therefore what you did and what you observe are unrelated.

It would also not make sense that only some of the search engines would get blocked. More so since the default value of "Whitelisted domains" in the Configure WAF page reads

.googlebot.com,.search.msn.com

i.e. it allows BOTH Google AND Bing's bots. So we're really sure that the observed effect has nothing to do with what you did on the site.

I also see that between the last crawl and you filing the support request it's roughly a month. This is too low to decide that your site is not being indexed by search engines. Depending on the traffic of your site and the rate of content change on it the indexing will take place anywhere between a few hours to a few months. My blog gets indexed about once every two months. Our business site is indexed several times a day.

If you doubt that just disable the password reset rules we told you you could use in the previous ticket. Do remember that what you wanted to do really made no sense to begin with so we DID give you a workaround that's not a very good idea. Password security is maintained even in the case of account resets since the attacker would need to know the email address of the victim AND have full access to it. Also, you could always use Two Factor Authentication (TFA) which is built into Joomla! since version 3.2 (I know because I wrote that feature myself) for additional account security. Even if an attacker successfully resets someone's password they'll never be able to log in because they don't have the TFA secret. If they get their hands on the TFA secret they have already hacked your site, making the point of password security moot.