Wordfence “potentially unsafe operation” warning

Resolved

(@ruruuu99)

Hi there,

So I installed the Header, Footer and Post Injections plugin as I want to add custom code to the header. I inserted the links below so that the website favicon can also appear in mobile search results (as it currently only appears on the desktop):

<link rel="apple-touch-icon" sizes="180x180" href=/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32"
href="/favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16"
href="/favicon-16x16.png">
link rel="manifest" href="/site.webmanifest">
link rel="mask icon" href="/safari-pinned-tab-svg" color="#5bbad5">
<meta name="msapplication-TileColor" content="#da532c">
<meta name="theme color" content="#ffffff">

After inserting it in the <head> part of the pages, Wordfence stated the following: "A potentially unsafe operation has been detected in your request to this site Your access to this service has been limited. (HTTP response code 403)"

My question is - is Wordfence being overly-sensitive as it's detected that custom code is being inserted and it's not sure if the actual admin is doing that, or could adding the code above potentially open up the website to security risks? 

Really not sure what the HTTP response code 403 means either.

Given that Wordfence has detected this as an unsafe operation, shall I avoid adding in the code or mark that warning as a "false positive" and proceed with inserting the code anyway? 

If this isn't the correct platform to ask about this subject, it would be greatly appreciated if someone could point me in the right direction of who I can contact about this.

Many thanks!

The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)

Plugin Support wfmargaret
(@wfmargaret)

11 months ago

Hi @ruruuu99,

Wordfence likely sees the request as a false-positive and therefore causes a 403 as it makes a block. A 403 response means that an action or requested resource was blocked.

You can identify the reason by looking at the records that match the timestamps when these blocks occurred on your Tools > Live Traffic page. You may need to make a new request that returns a 403 so it’s easier to identify. When clicking any block line (or “eye” icon) to expand it, it will state the reason for the block in red text. Sometimes you’ll see an “ADD PARAM TO FIREWALL ALLOWLIST” button here which you can click to allow these types of requests in the future.

If there isn’t an option to Add Param to Firewall Allowlist, Learning mode can help. From the Wordfence Dashboard click on Manage WAF. Then you will see Basic Firewall Options > Web Application Firewall Status. Change the option to Learning Mode. Now perform the actions that were causing issues. This will help Wordfence learn that these actions are normal and it will allow them in the future. After you have finished performing the actions, switch the WAF from Learning Mode back to Enabled and Protecting. Now test to see if these actions work correctly.

Both allowlisting methods are described in our instructions in the link below:
https://www.wordfence.com/help/firewall/learning-mode/

Thanks,
Margaret

Thread Starter ruruuu99
(@ruruuu99)

10 months, 3 weeks ago

Thank you very much for your advice @wfmargaret ! It worked, much appreciated 🙂

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Wordfence “potentially unsafe operation” warning’ is closed to new replies.

Tags