Learning Mode Allow List Extremely Large

  • Resolved peripatetic

    (@peripatetic)


    4 weeks ago

    Hi,
    Have just had a WP site in learning mode for a couple of weeks while I was on vacation. 😉 When I got back I was surprised to find around 2700 entries in the allowlist.
    Most of them were from a single IP address. I’m pretty sure this was a scan, and that all these entries can be deleted. Here is a sample. 

    /wp-json/wp/v2/tags/6574 server.empty 5/7/2026, 9:40:31 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/tags/6575 request.body[email] 5/7/2026, 9:48:31 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/tags/6575 request.body[nonce] 5/7/2026, 9:48:34 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/tags/6575 request.body[s] 5/7/2026, 9:48:31 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/categories/6562 server.empty 5/7/2026, 9:41:37 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/categories/6587 request.headers[Cookie] 5/9/2026, 4:20:40 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/categories/6605 request.headers[Cookie] 5/9/2026, 3:05:47 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/pages/ request.body[email] 5/7/2026, 9:24:49 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/wp/v2/pages/ request.body[nonce] 5/7/2026, 9:24:50 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-admin/admin-ajax.php request.queryString[start] 5/7/2026, 6:37:45 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-admin/admin-ajax.php request.queryString[url] 5/7/2026, 6:37:47 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-admin/admin-ajax.php request.queryString[wvstest] 5/7/2026, 6:31:35 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-admin/admin-ajax.php server.empty 5/7/2026, 6:30:34 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/ request.headers[Cookie] 5/8/2026, 10:19:17 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/plugins/ request.headers[Cookie] 5/8/2026, 10:21:17 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/plugins/powerpress/ request.headers[Cookie] 5/8/2026, 10:23:40 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/plugins/user-role-editor/ request.headers[Cookie] 5/8/2026, 10:24:47 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/plugins/wordfence/ request.headers[Cookie] 5/8/2026, 10:25:21 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/plugins/wordpress-seo/ request.headers[Cookie] 5/8/2026, 10:25:57 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/plugins/wp-piwik/ request.headers[Cookie] 5/8/2026, 10:29:09 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-content/themes/ request.headers[Cookie] 5/8/2026, 10:19:43 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/ request.headers[Cookie] 5/8/2026, 10:17:19 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/oembed/ request.headers[Cookie] 5/8/2026, 10:18:09 AM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/oembed/1.0/ request.body[email] 5/7/2026, 8:28:42 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/oembed/1.0/ request.body[nonce] 5/7/2026, 8:28:44 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/oembed/1.0/ request.body[s] 5/7/2026, 8:28:42 PM Allowlisted while in Learning Mode. - 82.29.53.246
    /wp-json/oembed/1.0/ request.headers[Cookie] 5/9/2026, 11:59:59 AM Allowlisted while in Learning Mode. - 82.29.53.246

    So I have a few questions. First of all does this all look like stuff that has no business being in the AllowList. (I think I know the answer to this …)
    Secondly, can anyone explain what the different second terms indicate: request.headers[Cookie], request.body[email], server.empty etc. It seems each URL was scanned with all four methods. What’s going on here?
    Finally, is there a good method to bulk delete all the entries from 82.29.53.246?
    I may have some follow up questions when I’ve got rid of those and can see what else is in the AllowList!

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter peripatetic

    (@peripatetic)

    4 weeks ago

    OK, I’ve just found the Filter by IP option, so I’m presuming I just check Select All, and then delete. That answers the third question.

    Plugin Support wfmargaret

    (@wfmargaret)

    4 weeks ago

    Hi @peripatetic,

    Thank you for reaching out! You’re right on all counts. Those entries shouldn’t stay in the allowlist, and the cleanest path is exactly what you found (Filter by IP > Select All > Delete).

    Looking at the entries themselves, this was almost certainly an automated vulnerability scanner. The scanner hit many endpoints with varied payloads, and because Learning Mode is designed to allow regular activity on the site, the blocks that fired during that time were added to the allowlist.

    The format is request.<component>[key], and it identifies the specific part of the request that the WAF rule would have blocked. Each WAF rule has its own list of targets to inspect, so a single request can trigger multiple rules that examine different parts. That’s why the same URL shows up repeatedly with different second terms. Each entry corresponds to one rule on one target.

    Learning Mode isn’t really meant to run unattended for weeks on a live site. The intent is more “turn it on, perform the specific legitimate actions you want allowed, turn it off.” Otherwise, any noise from scanners, bots, or oddly formed legitimate requests gets baked in.

    Thanks,
    Margaret

      Thread Starter peripatetic

      (@peripatetic)

      3 weeks, 3 days ago

      In the end I went through all the rules, one IP at a time, and ended up deleting them all!

    Viewing 3 replies - 1 through 3 (of 3 total)

    You must be logged in to reply to this topic.