This documentation page does not apply to our software versions for Joomla! 4.0 and later versions. If you are not using Joomla 3 please consult the documentation index to find and read the correct version of the documentation.
The Blocked Requests Log viewer page
A firewall is worth nothing if it can't log the attempts to override it. Most usually you will see that the same kind of attacks are coming from the same IP addresses over and over again. Using this log viewer facility you can dive into the log, spot those IPs and note them down so that you can ban them (put them in the IP Disallow List).
Below each IP there is a link reading Add to Black List or Remove from Black List. Clicking the former will add the IP address of the relevant record to the IP Black List and that IP will be denied access to your site. The latter removes the IP address from the black list.
Note | |
---|---|
If you want to unblock someone who got their IP inadvertently blocked you will have to remove all records belonging to their IP address in FOUR (4) places: Site IP Disallow List, Blocked Requests Log, Auto IP Blocking Administration and Auto IP Blocking History. |
The block reasons, listed in the log and optionally sent to you by email are the following. The "Code" is what you need to enter in the "Do not log these reasons" or "Do not send email notifications for these reasons" options in WAF configuration to prevent these blocked requests from being logged or trigger an email respectively.
Code: 404shield
See the Configure WAF page, 404 Shield. The request was blocked by Admin Tools.
Code: adminpw
Someone tried to access your site's administrator section but he didn't provide the secret URL parameter. Admin Tools blocked him and prevented him from seeing the login page at all.
Code: ipwl
Someone tried to access your site's administrator section but his IP was not in the Administrator Exclusive Allow IP List. Admin Tools blocked him and prevented him from seeing the login page at all.
Code: not applicable
Someone tried accessing the front- or back-end of your site but his IP is in the IP Disallow List. Admin Tools blocked him and didn't allow him to see the content of your site.
Code: sqlishield
See the Configure WAF page, SQLiShield protection against SQL injection attacks. The attack was blocked by Admin Tools.
Code: antispam
The request contains one of the Bad Words you have defined and was blocked by Admin Tools.
Code: not applicable
Only for Joomla! 1.5, see the respective option in the Configure WAF page. The attack was blocked by Admin Tools.
Code: tmpl
See the Configure WAF page, Block tmpl=foo system template switch. The attack was blocked by Admin Tools.
Code: template
See the Configure WAF page, Block template=foo site template switch. The attack was blocked by Admin Tools.
Code: muashield
See the Configure WAF page, Malicious User Agent block (MUAShield). The attack was blocked by Admin Tools.
Code: not applicable
See the Configure WAF page, Bad Behaviour integration. The attack was blocked by Admin Tools. NO LONGER PRESENT SINCE ADMIN TOOLS 2.5.3
Code: rfishield
See the Configure WAF page, Remote File Inclusion block (RFIShield). The attack was blocked by Admin Tools.
Code: dfishield
See the Configure WAF page, Direct File Inclusion shield (DFIShield). The attack was blocked by Admin Tools.
Code: uploadshield
See the Configure WAF page, Uploads scanner (UploadShield). The attack was blocked by Admin Tools.
Code: xssshield
(Only on older sites) Cross Site Scripting block (XSSShield). The attack was blocked by Admin Tools. This has been removed in Admin Tools 3.6.7 as it was throwing too many false positives (legitimate requests being blocked).
Code: httpbl
See the Configure WAF page, SQLiShield protection against SQL injection attacks. The attack was blocked by Admin Tools.
Code: loginfailure
Someone tried to log in in the front- or back-end of your site with the wrong username and/or password.
Code: securitycode
Someone tried to log in the back-end of your site but provided the wrong Two Factor Authentication code. Please note that this feature has been removed since Admin Tools 3.5.0. If you see it, it probaby comes from an old version of Admin Tools.
Code: nonewadmins
Someone tried to create or edit an administrator user from the backend of your site. In this context "administrator user" means any user who belong in one or more User Groups that gives them backend login privileges. In a default Joomla! installation these are the users belonging to the Manager, Administrator and Super User groups.
Code: nonewfrontendadmins
Someone tried to create or edit an administrator user from the frontend of your site. In this context "administrator user" means any user who belong in one or more User Groups that gives them backend login privileges. In a default Joomla! installation these are the users belonging to the Manager, Administrator and Super User groups.
Code: configmonitor
Someone tried to change either the Global Configuration of Joomla! itself or the configuration (Options) of a component. Please consult the additional information saved with this blocked request to understand which configuration was attempted to be changed. The change may have originated from the backend or the frontend of your site.