Title: Self-blocking when publishing posts
Last modified: January 10, 2025

---

# Self-blocking when publishing posts

 *  Resolved [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/)
 * When I publish an entry in WordPress, for some reason, the firewall blocked operation:
   5406993: FW_Traversal. The website is connected to Cloudflare. I would not like
   to uninstall the plugin. Perhaps there is some way to add an operation to the
   list of allowed operations, similar to Wordfence. Could you tell me why it happened?
    -  This topic was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
    -  This topic was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).

Viewing 10 replies - 1 through 10 (of 10 total)

 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18237394)
 * You can turn off directory transversal blocking on the firewall options page 
   in your wp-admin, however it might be wise to investigate which plugin or code
   on your website has added hidden fields.or values to your post forms that contain
   these directory transversal strings because this code could lead to a security
   issue on your website that you may not be aware of.
 * when you’re on the edit post page but before you submit the form which is being
   blocked you can inspect the elements on the page in search for any fields on 
   that form that might contain “../” in the string values.
 *  Thread Starter [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18238407)
 * Here URL, which i was redirected when request blocked by firewall:
   [https://safe-load.gotmls.net/report.php?ver=4.23.73&attack%5B%5D=FW_Traversal&SERVER_REMOTE_ADDR=172.68.159.149&SERVER_HTTP_HOST=research.kr-labs.com.ua&SERVER_REQUEST_URI=%2Fwp-admin%2Fpost.php&SERVER_HTTP_REFERER=https%3A%2F%2Fresearch.kr-labs.com.ua%2Fwp-admin%2Fpost.php%3Fpost%3D289%26action%3Dedit&SERVER_HTTP_USER_AGENT=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F130.0.0.0+Safari%2F537.36](https://safe-load.gotmls.net/report.php?ver=4.23.73&attack%5B%5D=FW_Traversal&SERVER_REMOTE_ADDR=172.68.159.149&SERVER_HTTP_HOST=research.kr-labs.com.ua&SERVER_REQUEST_URI=%2Fwp-admin%2Fpost.php&SERVER_HTTP_REFERER=https%3A%2F%2Fresearch.kr-labs.com.ua%2Fwp-admin%2Fpost.php%3Fpost%3D289%26action%3Dedit&SERVER_HTTP_USER_AGENT=Mozilla%2F5.0+%28X11%3B+Linux+x86_64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F130.0.0.0+Safari%2F537.36)
 *  Thread Starter [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18238495)
 * I perfectly knows what is Directory Traversal attack and review code, but dont
   find nothing “../”. I think this firewall reaction is caused by Cloudflare proxy.
   I can’t find any other explanation yet. And frankly, it makes me very nervous
   because I can’t publish the post properly. And it makes no sense to disable the
   Traversal module completely, because it creates security risks.
 * And in my opinion, its not very correct that the blocking is performed on the
   side of [https://safe-load.gotmls.net](https://safe-load.gotmls.net), and not
   on the side of my host.
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18238752)
 * First, I don’t see how it could be caused by Cloudflare Proxies unless they are
   inserting a variable with a path that contains a directory transversal.
 * Slight correction here: disabling the Transversal module would not create a security
   risk, it would only stop blocking variables passed with Directory Transversal
   paths in them, which is only a problem if you have added something to your WordPress
   site that opens up a security hole creating that risk you are worried about. 
   To be clear, if you don’t have any code that could process an insecure path in
   the first place then you don’t need this protection. I’ll admit though that this
   protection is generally important because most people add a lot plugins and code
   that they don’t complete know inside and out and so they cannot be sure that 
   they have not opened up some kind of security hole. That’s why it’s nice to have
   a firewall watching your back.
 * Why do you feel that it’s not correct to be redirecting attacks to my safe-load
   URL? I have done this because this type of redirect diverts the server load away
   from your server which is a critical feature of the Brute-Force Protection and
   is the reason why it not only prevents bots from guessing your password but also
   prevents a flood of bad login attempts from causing a DoS attack to your server.
 * If you cannot find any directory transversal fields on your Post Form then would
   you be willing to capture the HTML code rendered in your browser’s Inspector 
   before you submit a test Post that you know will be blocked and then send me 
   that HTML in a direct email so that I can test it and debug the firewall from
   my end?
 * eli AT gotmls DOT net
 *  Thread Starter [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18239174)
 * The URL address where the firewall rule was triggered is specified: SERVER_REMOTE_ADDR
   =172.68.159.149
   This IP address belongs to the Cloudflare IP-range. And this 
   IP is constantly changing.
 * Why I feel that it’s not correct to be redirecting attacks to my safe-load URL?
   Because a third party services involved to obtain sensitive data. A report is
   generated on the side of your server, not mine: [https://safe-load.gotmls.net](https://safe-load.gotmls.net)
   This is the main reason why I avoided your plugin for a long time. But now I 
   wanted to test it, because Wordfence is very heavy and resource-intensive. Accordingly,
   your server stores information that actually concerns only me. The first rule
   of security is the rule of zero trust. But in this case, of course, it doesn’t
   matter.
 * I looked at the source code, intercepted requests through BurpSuite, and found
   only one thing – Cloudflare’s challenge protection. I didn’t find anything else.
   For now, I disabled the plugin GOTMLS because it’s impossible to work.
 * As for me, it would be nice if the firewall provided some logs for customers.
   What exactly it saw, why and when it was triggered, what code triggered it… 
   
   Thanks for answers.
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
 *  Thread Starter [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18239184)
 * Analysing the fields, I found only a placeholder that relates to the wordpress
   functionality:
 * `placeholder="http://…’`
 * Also:
 * `/js/../../images/admin/blockquote-info-ico.png')">`
 * Could this be the reason?
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
 *  Thread Starter [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18240280)
 * The problem has been detected! If the article in wordpress editor contain text`/
   etc/shadow`, the firewall blocking the request for publishing)). I checked it
   on other sites.
 * The logic of GOTMLS needs to be improved.
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
    -  This reply was modified 1 year, 3 months ago by [KR. Laboratories](https://wordpress.org/support/users/krashlab/).
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18241006)
 * DING! DING! DING! You found it! Thanks so much for sticking with it and finding
   the cause. I know your were about to give up and I personally really wanted to
   find out what the firewall was catching (mostly for my own peace of mind TBH).
 * Anyway, it is certainly that image path that is getting flagged by the firewall.
   Is there any reason why that field needs to have the ../ in the path and can’t
   just be a directly path to the image?
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18241042)
 * Oh, Just saw your last post here. I think I understand. You might be blogging
   about the /etc/shadow file, and that might be bad if that path was found in a
   hidden meta field all by itself, but because you are talking about it in the 
   context of a paragraph of text it should be ok, right?
 * If this is the case and I am understanding the situation correctly then I certainly
   see your point and I will look for a solution to ignore that type of usage so
   as to avoid false positives like this one.
 * What about that image path with the ../ in it was that put there by a specific
   plugin or what?
 *  Thread Starter [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * (@krashlab)
 * [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18241632)
 * Yes, I wrote an article, and the text simply mentioned `/etc/shadow`.
 * As for the image path, it did not affect the triggering.

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘Self-blocking when publishing posts’ is closed to new replies.

 * ![](https://ps.w.org/gotmls/assets/icon-256x256.png?rev=1001824)
 * [Anti-Malware Security and Brute-Force Firewall](https://wordpress.org/plugins/gotmls/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/gotmls/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/gotmls/)
 * [Active Topics](https://wordpress.org/support/plugin/gotmls/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/gotmls/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/gotmls/reviews/)

## Tags

 * [blocking](https://wordpress.org/support/topic-tag/blocking/)
 * [firewall](https://wordpress.org/support/topic-tag/firewall/)

 * 10 replies
 * 2 participants
 * Last reply from: [KR. Laboratories](https://wordpress.org/support/users/krashlab/)
 * Last activity: [1 year, 3 months ago](https://wordpress.org/support/topic/self-blocking-when-publishing-posts/#post-18241632)
 * Status: resolved