Please explain “New Install File Probing” Alert

Hi @jstepak , thanks for reaching out.

Can you please confirm the IP address these attacks are coming from? We have previously seen this when hosts modify core files which is common for most hosting providers.

For context, these blocks are triggered by hitting example[.]com/wp-admin/install.php, which in return generates the blocked by firewall for WordPress New Install File Probing.

These types of attacks are explained in detail here: https://www.wordfence.com/blog/2017/07/wpsetup-attack/ 

Please note we do not recommend blocking IPs permanently, as Wordfence is already blocking them, and attackers rarely reuse IP addresses. For more information on blocking, please check out the resources below:

https://www.wordfence.com/help/blocking/#ip-address 

https://www.wordfence.com/blog/2017/11/should-permantly-block-ips/

Let me know in case you have any further questions.

Thanks,

Mark.