Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) Gecko/20061010 Firefox/2.0 sometext

Is it possible to exclude from logging in Traffic Inspector all user-agents that contain sometext? Example *sometext*?

1. (‘Connection aborted.’, OSError(“(32, ‘EPIPE’)”))
2. The app returned “Error 502 (Server Error)!!1”.
3. The app returned “Sorry… body { font-family: verdana, arial, sans-serif; background-color: #fff; color: #000; }GoogleSorry…We’re sorry…… but your computer or network may be sending automated queries. To protect…”.

Right now it seems to be triggered by the traffic inspector, although for good measure I followed the recommendations in this thread to whitelist “/?wc-ajax=get_refreshed_fragments”. I have safe mode enabled (all AJAX). I’ve also turned off anti-spam engine for registration, comment and other forms. I only have recaptcha enabled (around the same time as this issue started happening as I was receiving a lot of of bot registrations).

Still, it seems to be an issue in traffic inspector. Here are the logs from one legitimate customer who was locked out:

xx.x.xx.xxx
	June 27, 2022, 1:52 am	
Form submission denied IP address is locked out
/shop/product-category/product-name

xx.x.xx.xxx
June 27, 2022, 1:39 am
Malicious request denied IP address is locked out
/wp-content/plugins/woocommerce-cart-add-ons/assets/css/frontend.css

xx.x.xx.xxx
	June 27, 2022, 1:39 am	
Form submission denied IP address is locked out
/

xx.x.xx.xxx
June 27, 2022, 1:39 am
IP blocked Multiple erroneous requests`

At this point I’m at a loss as to what else I can do. I’ve been whitelisting IPs as I go, but this is still costing me a lot of money to have customers who can’t checkout. I suspect if I disable traffic inspector, then the issue will be resolved, but then it just seems pointless to have the plugin at all if I’m not using the main features.

Is there anything else I can do to stop these false positives?

When requesting a password reset email users are given the 403 You Are Not Allowed to Proceed page.

Is there some way to whitelist this request without having to whitelist all queries to wp-login? Is there another solution?

I saw this issue was addressed in 8.5 but I am running 9.0.

Sidenote I would really like the ability to customize this error page as well as I feel the page is a bit harsh toward well-intentioned users, but that is bonus request.

Happy to provide any further info if helpful.

Thanks to authors for all your work on this plugin.

I would like very much that it will return to the last page I was in instead of page #1.
For example, if I’m in page #20 and blacklisted an IP, I want the Suspicious activity tab to return to page #20 and NOT to #1.
This will make the workflow more intuitive when having many pages in the inspector list.
Thanks

Thank you very much for your help and reply.
Best regards from Calau

J?rg Rothhardt

https://mysite.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user

So in Traffic Inspector Settings, in the Request whitelist, I am adding this REGEX pattern:

{\/wp-json\/wp\/v2\/users\/\?who=authors&per_page=\d*&_locale=user$}

And I am getting an error that says: You may not specify the query string with a question mark: {\/wp-json\/wp\/v2\/users\/\?who=authors&per_page=\d*&_locale=user$}

Thanks,
olaf