WPF2B_EVENT_WAF_UPDATE_OPTION

Unauthorised protected-option update detected.

Premium only

Premium listener: WPF2B_EVENT_WAF_UPDATE_OPTION.

Premium emits this event when option protection detects an update to a protected site or network option that is not authorised or exempt.

syslog	Facility	WP_FAIL2BAN_EX_WAF_LOG
	Level	WARNING
	Example	`WAF[blocked] update_option(marvin-gpp)="happy" on fqdn.example.com from 192.0.42.1`
fail2ban	Filter	wordpress-wpf2b-waf.conf
fail2ban	Rule	`update_option\(<F-OPTION_NAME>.?</F-OPTION_NAME>\)="<F-OPTION_VALUE>.</F-OPTION_VALUE>"<_tail>` <option_name> Name of the core WordPress option being updated. <option_value> The JSON-encoded value being set. The following options are used for encoding: JSON_NUMERIC_CHECK JSON_UNESCAPED_SLASHES JSON_PRESERVE_ZERO_FRACTION JSON_INVALID_UTF8_SUBSTITUTE

WAF messages use WAF[blocked] when enforcing a block, WAF[detected] in logging-only mode, and WAF[error] for diagnostic errors. All use WARNING. The shipped WAF filter matches blocked messages only.

Premium records the available raw request body and HTTP headers with every WAF event, independently of the general extra-field controls; see Privacy and stored data and Using Premium event history.

EventData waf_data contains the option name in option_name and the full new value in option_value. The value can contain credentials or other sensitive information.