Support

In the past few days I've been notified of severak security exceptions of my super admin IP address (white listed), even when not logged in. Today, I received numerous notifications - about 30 over 12 hours - and I was logged in only the last two hours of those reported exceptions.

If I search the exceptions list, my IP is not listed. To troubleshoot, I removed my IP from white listing. My IP exceptions were still not logged, even though exceptions were being reported during that period. Furthermore, I should have been blocked automatically because the exceptions exceeded the limit I had set.

I had the WAF set to notify me of all exceptions.

Is this an Admin Tools issue or something with my IP and the server or ????

Thanks.

Nickolas,

Thanks for your quite detailed reply and my apologies if I wasn't as clear as I could have been.

I confirmed my IP address via ip-lookup.net and other online sources, like iplocation.net.

The security exceptions that are being emailed to me by Admin Tools are for Admin Query Strings by my IP address. These are not logged in the security exceptions log.

In "Configure WAF", I have the following set to Yes:

Treat failed logins as security exceptions
Include password in failed login email
Log security exceptions
IP blocking of repeat offenders
Email on failed admin logins
Email on automatic IP blocking

I don't appear anywhere in the security exceptions log. The emailed exceptions for failed log in do NOT include the password, even though the WAF is configured to send notifications.

I haven't changed the WAF settings for years. I actually didn't update my new IP in the WAF whitelist until yesterday, after checking settings to see why all the exceptions' emails were hitting my inbox.

In March this year, the host (not me) upgraded to a faster Linux server, but that did not trigger any unusual activity.

My IP did change recently after several years being the same. The only numbers that changed in the address were in the final set of IP numbers.

Several weeks after the host's server upgrade, the server admin banned this new IP (for reasons unknown), then whitelisted that new, changed IP (and the one that is triggering the security exceptions emails) because the ban had locked me out of accessing the site and emails, obviously. (This is not a large commercial host.)

The above IP banning/restoration occurred several weeks ago, however, and the spurious exceptions' emails just started over the past few days.

So the only thing that has really changed over the last several months is, first, the server upgrade, and secondly, my IP address. Why that would cause these exceptions to be triggered just over the past few days is a mystery.

Today, so far, there have been no exceptions.

This issue may have nothing to do with Admin Tools, but with a server configuration issue. I wouldn't know. Way over my head.

I will prod the host again about it, along with the CDN question you raised.

Thank you.

I should really mention one detail about the "host server" in this discussion that is important: the website where this Admin Tools issue is occurring only hosts that one website. They are not the host where I have another Admin Tools app installed, nor are they my primary host for my other sites.

Sorry to omit this earlier if that is an useful fact in the discussion.

Thanks, again. Nicholas. The problem events have stopped but I will do as you suggest, just in case.

As always, I really appreciate your advice. Thank you.

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.