Javascript cannot be saved in site when new Firewall is active

Hi dmori,

You can make the firewall learn that these requests are safe by going to the Firewall page on the Wordfence menu, and switching to “Learning Mode,” then completing what you were trying to do. After that, you can change the firewall back to “Enabled and Protecting” and the same requests generally should not be blocked anymore. More details on Learning Mode are available here:
https://docs.wordfence.com/en/Web_Application_Firewall_-_How_to_use_Learning_Mode

If this corrects the issue, can you also send me a screenshot of the “Whitelisted URLs” table at the bottom of the Wordfence firewall page? This will help determine if we need to add these requests to the built-in whitelist or add any special parameters.

-Matt R

Thanks Matt, I will try doing this.

I use Beaver Builder and the Beaver Builder theme. It lets you add javascript/code in the Customizer (theme) or on individual pages and globally in the plugin.

The particular one which highlighted the problem to me was trying to add Help Scout beacon embed code.

Our clients can add their own javascript to connect external services (like email marketing, facebook, etc…) – so it can come from a variety of sources. However, they may not try to add it until they are ready (which could be months down the line from getting their site).

We also hide Wordfence from them so they don’t have access to the settings. If it doesn’t learn what they want to add (when they don’t know what they’ll want to add until they reach that point) then trying to add any code will not work for them (and we will have to de-activate the firewall each time etc…. which won’t be a workable solution for us).

I’m not sure how the Firewall works, but is there a way that code added via the Beaver Builder plugin and theme would be accepted by the Firewall, and any other ways to add such code would not work? Or is there any settings I can add in the safe list to make this work for Beaver Builder.

Thanks once again.

Hi Matt, I’ve done some test with following results:

I put it in learn mode and added code to customizer section of BB theme.
It created a new whitelisted URL:

/wp-admin/admin-ajax.php – request.body[customized] – with the user who added it.

I’m not sure if it will work for all users or just the user listed here.

I added the code to the BB plugin and it added for example following:
/page-name/ – request.body[fl_builder_data][settings][js]

If you then go to enabled in Wordfence Firewall you can add code.

However, the problem is that with the BB plugin it is URL specific. If you try to add javascript code on any other page in the BB plugin, it will not work – just goes in an endless loop of trying to save.

I also tried to add it just with the slash / to see if it would work on all pages, but it did not. It also added my IP address.

It’s a real shame that there is no way to add it so it works for all pages and all users who have access to the BB page builder.

Is there a way to do this? Any suggestions on how i can get this to work?

On the User and IP sections – does this mean only this user can use it (and from this IP) or is it just for information so we know who added and where from? Also does it mean all users can add js code or only the specific user listed.

I had exactly this same problem with Beaver Builder. I like Wordfence too so I hope you can answer dmori’s questions above. Wish I had found this thread sooner!

I isolated my problem to WordFence with embedding a Wistia video on a Page with my BeaverBuilder plugin on my BeaverBuilder theme.

I was referred to this thread by Beaver Builder support.

I followed WFMattR’s suggestion (earlier in this thread) and I was then able to save my page with Wordfence active.

However, it seems I may have to do this for every page I create going forward. I cloned the page that was now whitelisted by Wordfence and attempted a basic edit. Upon saving, I was greeted with the eternal save animation. Doh.