Support

On the face of it, it looks like prior security exception notifications are being reset and it's rescanning the logs and treating them as new events.

No, this is not the case. Emails are sent when the security exception is triggered, not after the fact. It wouldn't make sense to get an email notification for a security exception that happened in the past. That would be useless.

I'd also like to note that security exceptions typically happen when someone is attacking your site from outside your server. If someone is blindly running a bot against your site or has launched a DoS / DDoS attack deleting your site and reinstalling it won't help you at all; your actions have absolutely no effect on what a third party, outside your server and outside your control, has decided to do.

In any case, the information you've provided so far is unusable for me to help you. You have excluded all the relevant information.

Have you turned on email throttling and set up a reasonable throttling threshold in each Admin Tools email template? If not, you will be receiving an email for each and every security exception. If your site is being targeted for a DoS, DDoS or being scanned / attacked by an automated script ("bot") you will be inundated with email.

What kind of exceptions are you receiving? This is very important to understand the nature of your alleged issue. For example, if you are getting thousands of failed login security exceptions it means that you've enabled the Treat Failed Logins as Security Exceptions option (enabled by default) and someone is blindly using an automated script to try combinations of common usernames and passwords in hope they will be able to gain Administrator privileges on your site.

Have you enabled IP blocking of repeat offenders and IP blacklisting of persistent offenders? If not, the attacks are logged and stopped but the offending IP address is not prevented from retrying. If there's an ongoing automated attack you will see thousands upon thousands of security exceptions logged and emailed to you.

Without this basic information for starters I can only speculate. I don't know about you, I am a really bad oracle and an even worse mind reader :) Please give me this information so I can help you understand better what is going on.

I can tell you in absolute certainty that the emails are sent without looking at the log entries. Moreover, I'm an engineer (Mechanical Engineer by field of study, Software Engineer by profession). I don't make assumptions, I look at the code :)

Speaking of code, please open wp-content/plugins/admintoolswp/app/plugins/waf/util/exceptionshandler.php around line 167. As you can see the email is part of the security exceptions logging process. The email is sent based on the information sent into the logBreaches() method which as you can trace yourself is only called when a security exception is triggered for the current request.

The fact that you are on a private network does not necessarily mean that nothing else on your internal network is compromised and trying to brute force the login. Moreover, it's possible that you have some other automation going on which might be trying to perform a login. In fact, you can see in wp-content/plugins/admintoolswp/app/plugins/waf/admintools/main.php, method registerFeatures(), that we merely telling WordPress to register our onUserLoginFailure method to the wp_login_failed handler. If your site is built in a way that triggers WordPress' wp_login_failed continuously then yes, you will get thousands of emails.

For what it's worth, we didn't change anything regarding tracking failed logins as security exceptions in the past 11 months and that was simply removing the ability to log the failed login's password. The implementation of that feature dates back to 2017.

I don't see any other change which could be relevant to your issue either. Maybe if I had the Target URL of the exception I could help you better.

Regarding some other points I asked you about.

Setting the limits in each email template is necessary but not enough to set email limits. You have to go to Configure WAF, Logging and Reporting and set Enable security exception email throttling to Yes. Do note that if you have dozens of malicious requests hitting your site at the same time the limit might be exceeded.

Regarding IP blocking, I was not asking you about your server configuration. I was asking you about your Admin Tools configuration. This is in the Configure WAF page under Auto-ban. If it's enabled as you say and the offending IP is the same it should be blocked. But hold your thought on that because I found more clues.

The very fact that your security exceptions log doesn't list the security exceptions you are being emailed about shoots down your suspicion about the log being parsed to send out emails – even if you don't look at the code like I did.

Moreover, your log states that the IP address that causes the security exception (at least the one you screenshotted for me) is 17.58.101.202. This IP address belongs to Apple. Namely, it's part of AppleBot. It is normally used by things like Siri and Spotlight Suggestions. This could be a clue as to what is going on. Furthermore, if it's AppleBot hitting your server it would explain why it doesn't get blocked; it uses a lot of different IP addresses. Each request comes from a different IP address, therefore a single IP address wouldn't be blocked as it would individually not trigger enough exceptions.

I can't tell you WHY AppleBot is hitting your server, I cannot tell you why that comes through to your internal network and I cannot tell you why WordPress believes that there is a failed login when this happens. I can only tell you that based on the one email you shared with me it's AppleBot hitting your site that triggers the security exceptions.