• Peopleunit

    (@peopleunit)


    I have experienced on several occasions the past couple of months when logged in as admin on my WP site, where something triggers a security block on my IP address.

    I completely lose access to my site because of the IP block and have had to contact support at my host provider to have them remove the block.

    Today when it happened I asked them to check their error logs to maybe help figure out what was happening. Here is the error message in the log. Maybe someone here can decipher what this error means and what might be causing it. It only happens when working with WordPress.

      A particular mod security rule was triggering while you
      accessing your website.

      Access denied with code 406 (phase 2). Pattern match
      “(?:\\b(?:(?:type\\b\\W*?\\b(?:text\\b\\W*?\\b(?:j(?:ava)?|ecma|vb)|application\\b\\W*?\\bx-(?:java|vb))script|c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder|iframe\\b.{0,100}?\\bsrc)\\b|on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|
      …” at REQUEST_FILENAME. [file
      “/usr/local/apache/conf/modsec2.user.conf”] [line
      “117”] [id “1234123404”] [msg
      “Cross-site Scripting (XSS) Attack”] [data
      “.cookie”] [severity “CRITICAL”] [tag
      “WEB_ATTACK/XSS”]

    It has occurred from both my Windows PC, and Ubuntu on another PC, so I think it might be a problem with my install itself.

    The site in question is at http://gofishygo.com/peopleunit

Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)
  • The topic ‘XSS Security Threat?’ is closed to new replies.