Concern about actions after "managed challenge"

[ricardo.araujo330]

What is the name of the domain?

floresnocais.pt

What is the issue you’re encountering

I’ve noticed an increase in “managed challenges” in WAF events and the actions taken on my site have me worried. Here are some screenshots so you can see what these actions were and what measures I should take. Thank you

What is the current SSL/TLS setting?

Full

Screenshot of the error

[fritex]

@ricardo.araujo330

what these actions were

More information about Managed Challenge actions could be read at the link from below:

Firewall rules actions · Cloudflare Firewall Rules (deprecated) docs

In general:

Challenges · Cloudflare Web Application Firewall (WAF) docs

Actions for “Managed Challenge”:

Actions reference · Cloudflare Ruleset Engine docs

I hope the above helps a bit.

@ricardo.araujo330

what measures I should take

For a WordPress login, if it’s only you and/or few more users, I’d consider Zero Trust for login page

• https://www.cloudflare.com/learning/security/how-to-improve-wordpress-security/

How to Use Cloudflare Zero Trust For WordPress Login Pages

More usefull things for Cloudflare & WordPress:

Wordpress protection

I’d suggest you to block any request to the path xmlrpc.php via Firewall Rule, otherwise disable it in WordPress (or via plugin, or in functions.php). I’d suggest you to either: Create a Firewall Rule and make sure to present JS Challenge for each request on the wp-login.php path Add Google reCaptcha on the login form via plugin Limit countries which can access, while other’s will be presented with the Cloudflare’s 1020 error page The other way would be to configure and use Cloudflare Acce…

[ricardo.araujo330]

Hi @fritex

Thank you so much for the quick answer.
My concern is that js challenge is being passed by someone acting via “Tor” country and trying to access paths like this:

xmlrpc.php
/en/wp-content/uploads/p3d/evil.php
/en/evil.php
/en/wp-content/uploads/simple-file-list/evil.jpg

About xmlrpc.php i’ve already blocked it via custom rule. About the others, I don’t know if I should do something else.

For wp-login i don’t have zero trust but I have that path blocked by custom rule too.

[fritex]

@ricardo.araujo330

My concern is that js challenge is being passed by someone acting via “Tor” country and trying to access paths like this:

If you’re not concern about having lower impact on the server CPU and strange “Tor” requests, I’d consider blocking the “T1”, Tor as Country in Custom Firewall Rule.

Knowing me and my colleagues using WordPress Dashboard never coming via TOR Web browser(s), I’d remove this risk and block all requests (even to my Website, not just WordPress dashboard) and eliminate any “bad traffic” and “bad players” out there

However, that’s not always the case.

The paths like you’ve stated, I’ve see them in my Firewall Evets as well.

If your origin host/server isn’t affected by some malware or there is no malicious code, no nulled plugins and themes, I’d say it’s just probing to find some of the “well known and existing” paths to execute those scripts and make harm to your Website and there are a lot of those kind of requests swimming on the network from different ASNs and providers, scanners, etc. which is good to block.

[ricardo.araujo330]

Thank you for your advice. I’ll go ahead and try blocking Tor traffic as you suggested. I believe it’s the best course of action to reduce potential risks and eliminate any unwanted traffic to my site. I appreciate your input and will monitor the impact on server performance after making this change.

Thanks again!