Visitor trying to see my Wordfence logs?

Not sure of answer, but with Wordfence being the best security plugin, and the amount of installs (millions), I’m certain that hundreds if not thousands of criminals are sitting in their dark, smoke filled rooms trying to figure out Wordfence and break it.

Main thing here, is if you’re trying to figure out the criminal hacker mind, it’s a waste of time.

MTN

Would it be a bad idea to blacklist URLs that contain “wordfence_log”?

Hi,

The “wordfence_logHuman” URL is a normal part of Wordfence. It is used to show which visits are humans and which are likely to be bots on the Live Traffic page, and should normally be visited only by real users. It loads in the background like .js and .css files, so they won’t see anything as it occurs.

The other URLs hit between the first pageload and the logHuman call are normal parts of WordPress, but I don’t think they are normally loaded by every browser. The user might be using a browser extension that tries to pre-load all URLs on a page, but I’m not certain.

-Matt R

Ah, thanks. But why example.com/xmlrpc.php? I thought anyone hitting anything with xmlrpc (which I have disabled) had bad intentions.

WordPress includes a line like this in the “head” tag, so crawlers or browser extensions may pick it up:
<link rel=”pingback” href=”https://domain.com/xmlrpc.php”&gt;

A ‘GET’ request on xmlrpc.php is generally ok, and ‘POST’ requests might be ok, depending on the features your site uses. It does seem unusual, but a single request on that URL might not be malicious.

-Matt R