Title: firewall automatically whitelisting
Last modified: August 31, 2016

---

# firewall automatically whitelisting

 *  Resolved [jeffersonpowers](https://wordpress.org/support/users/jeffersonpowers/)
 * (@jeffersonpowers)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/firewall-automatically-whitelisting/)
 * I’m finding that on several WordPress installs, the new firewall is automatically
   whitelisting urls that are non-existent or appear to be paths to plugins that
   I don’t have installed. Many of them appear to come from URLs that show as blacklisted
   when I do a reverse ip lookup.
 * I’ve deleted most of them, but I’m not sure about this one:
 * **URL:** /sites/all/libraries/elfinder/php/connector.minimal.php
    **Param:** 
   request.fileNames[upload][0] **Source:** Whitelisted while in Learning Mode.
 * The ip this one came from doesn’t come up as blacklisted in a reverse ip search,
   but does this look like something that should be whitelisted?
 * [https://wordpress.org/plugins/wordfence/](https://wordpress.org/plugins/wordfence/)

Viewing 4 replies - 1 through 4 (of 4 total)

 *  [shinerweb](https://wordpress.org/support/users/shinerweb/)
 * (@shinerweb)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/firewall-automatically-whitelisting/#post-7368189)
 * Out of interest, do you have your site set to **not** return 404’s for non-existent
   pages?
 * There was a _bug _in earlier versions that created entries for pages that returned
   404’s but a fix was released for that. I’m just wondering if you have your site
   set to not return a 404 (and perhaps load a search page).
 *  Thread Starter [jeffersonpowers](https://wordpress.org/support/users/jeffersonpowers/)
 * (@jeffersonpowers)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/firewall-automatically-whitelisting/#post-7368234)
 * I’m not sure. All three sites in question return a search page when you try to
   go to a non-existent page, but only one of them says “error 404, page not found.”
 * In general, should there be whitelist entries in the firewall for urls that don’t
   exist on my site or server?
 *  [jzahnFox](https://wordpress.org/support/users/jzahnfox/)
 * (@jzahnfox)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/firewall-automatically-whitelisting/#post-7368338)
 * I see these, too. I think they were whitelisted while WordFence Web Application
   Firewall was in Learning Mode. I hadn’t been to the site for a while and WF was
   autoupdated with the WAF in April and Learning Mode was automatically set for
   one week subsequent to the update. It seems there were probes for exploits common
   enough during the learning period that WF WAF learned them to the whitelist.
 *  Plugin Author [WFMattR](https://wordpress.org/support/users/wfmattr/)
 * (@wfmattr)
 * [10 years, 3 months ago](https://wordpress.org/support/topic/firewall-automatically-whitelisting/#post-7368389)
 * Hi all,
 * [@shinerweb](https://wordpress.org/support/users/shinerweb/) is correct that 
   an earlier version did allow hits that generated 404s to be whitelisted, so some
   of the entries may be before that time — since 6.1.4, 404 hits are no longer 
   whitelisted. If you do have a plugin that redirects 404s to another page, that
   may prevent this from working.
 * If you recognize that these don’t belong to plugins (or non-WordPress php software
   you have installed), then it is safe to remove them. As more attacks are identified
   by our research team, these will be prevented from being added to whitelists 
   even for plugins you do have, too.
 * Once your site is set to “Enabled and Protecting”, no more whitelist entries 
   will be added automatically, since they only happen in learning mode.
 * Let us know if you have any other questions!
 * -Matt R

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘firewall automatically whitelisting’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

 * 4 replies
 * 4 participants
 * Last reply from: [WFMattR](https://wordpress.org/support/users/wfmattr/)
 * Last activity: [10 years, 3 months ago](https://wordpress.org/support/topic/firewall-automatically-whitelisting/#post-7368389)
 * Status: resolved