WAF rule to block all directories that are not whitelisted

General Rules
1

What is the name of the domain?

What is the error number?

none

What is the error message?

none

What is the issue you’re encountering

I want to block all requests that target non existing plugin/directories and only allow requests to plugin directories that I include in this expression. The problem is that even though I added a “/*” legit requests to subfolders of specified allowlisted directories get blocked.

What steps have you taken to resolve the issue?

This is the current expression I’m using

(http.request.uri contains “/wp-content/plugins/” and not (
http.request.uri contains “/wp-content/plugins/better-search-replace/" or
http.request.uri contains "/wp-content/plugins/perfmatters/” or
http.request.uri contains “/wp-content/plugins/query-monitor/" or
/”
))

BLOCK

===

But requests to /wp-content/plugins/perfmatters/assets/images/ get blocked as well. Any idea where I got that expression wrong?

3

It looks like you tried to use wildcard * characters, and those aren’t valid in rulesets:

When using “contains”, there’s no need for wildcards.

4

Thank you for your reply @sdayman

I originally tried just with “contain” and it blocked subfolders as well.

EDIT: But i did not use http.request.uri.path but http.request.uri. Will try with uri.path and report back

1 Like
5

still blocking legit subdirectory with http.request.uri.path

6

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.