Firewall rules (abbreviate to cover more)

Hi!!, I have 2 questions…

Question 1:
I have thousands of user agents with this data …
python-requests/2.18.4
python-requests/2.26.0
Python-urllib/3.9
Python-urllib/2.7
Instead of blocking one by one … could I use the expression: (http.user_agent contains “Python”) and block in bulk? or is it case sensitive? or must use the full user agent?

Question 2:
It happens to me that thousands of thousands of logs lead to the WP path, my site is not with WP and there are no such paths on my site.
The vast majority blocked them with the following expression:
(http.request.uri.path contains “/wp-”)

Others like /admin and /administrator also appear…
Would using the following expression block both at the same time?
(http.request.uri.path contains “/admin”) or must be full text…?

The same thing happens to me with /new and /news … /blog and /blogs

I don’t want to generate so many entries in the firewall to make everything more verbose. It would be to abbreviate the terms but to monopolize the great majority.

Any links to learn exactly how to use the expressions?

Thank you very much!!

2 posts were merged into an existing topic: Firewall expresssion to block