WPF2B_EVENT_WAF_WP_DELETE_USER

Unauthorised attempt to delete a user.

Premium only

Premium listener: WPF2B_EVENT_WAF_WP_DELETE_USER.

Premium emits this event when user-deletion protection detects an attempt that lacks the required capabilities and no caller exemption applies.

syslog	Facility	WP_FAIL2BAN_EX_WAF_LOG
	Level	WARNING
	Example	`WAF[blocked] wp_delete_user(42)="Arthur" on fqdn.example.com from 192.0.42.1`
fail2ban	Filter	wordpress-wpf2b-waf.conf
fail2ban	Rule	`wp_delete_user\(<F-ALT_USER_ID>\d+</F-ALT_USER_ID>\)="<F-ALT_USER>.*</F-ALT_USER>"<_tail>`

WAF messages use WAF[blocked] when enforcing a block, WAF[detected] in logging-only mode, and WAF[error] for diagnostic errors. All use WARNING. The shipped WAF filter matches blocked messages only.

Premium records the available raw request body and HTTP headers with every WAF event, independently of the general extra-field controls; see Privacy and stored data and Using Premium event history.

EventData waf_data contains the affected user ID in id and login name in username.