Support

Hi Michele,

Bad Behaviour is a third party library. You can read more about it here. Please note that Bad Behaviour has several sub-cases. The one you posted (User-Agent was founf on blacklist) means that the visitor tried to use a forbidden user agent string, e.g. a hacking program or am otherwise innocent utility which is frequently used for hacking purposes. However, Bad Behaviour throws a lot of false positives, so you needn't take it too seriously.

Likewise, the XSSShield tries to protect you from cross-site scripting attacks, i.e. someone trying to post malicious Javascript code with the intent to lure your site visitors to a malicious page. However, it is not fool-proof and can lead to a lot of false positives.

I would recommend against putting IPs in the black-list for these two specific reasons. By doing that, you are most likely blacklisting legitimate users who were misfortunate enough to get hit by a false positive! Furthermore, IPs are dynamic and what belongs to a hacker now, may belong to a legitimate visitor in 3 hours. You don't want to block these IPs forever. Just use Admin Tools' automatic IP blocking which automatically manages a temporary ban of IPs which cause repeated security exceptions in a short period of time. These are most likely caused by hackers and it's a good idea to block them for a short cool-off period. Around 30 minutes is more than enough.

Pretty much, yes, this is what it means. Please note that XSSShield and Bad Behaviour are known to throw a lot of false positives. I mean, they sometimes block a legitimate request because it "looks like" a hacking attack, even if it's not. No automated scanning tool is perfect.

You're welcome!