Message starts with or ends with

Created on 23 June 2023, about 1 year ago
Updated 21 July 2023, 11 months ago

How to define if a url starts with certain content?

I have tons of "page not found" messages in Watchdog which show me that some bot is trying to access content like:

"wp-content/plugins/wp-daft/t62.php"
"wp-content/updates.php"
"wp-commentin.php"
and more

So the path looks like: www.example.com/wp-content/plugins/wp-daft/t62.php

How do I create a rule that checks IF the address STARTED with "wp-co/"

Should I write %wp-co as the message?
Is that the wildcard?
I tested wildcards but then one must know what is indeed a wildcard. Usually it's an asterisk * but apparently not here.
Can anyone tell me?

πŸ’¬ Support request
Status

Active

Version

1.11

Component

Documentation

Created by

πŸ‡­πŸ‡°Hong Kong BassPlaya

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @BassPlaya
  • πŸ‡ΊπŸ‡¦Ukraine goodboy Kharkiv, Ukraine

    Hi, look at the settings page /admin/config/people/autoban/settings
    You can choose "Use wildcard" and try to use 'wp%' pattern.
    Or you can select Query mode to REGEXP and use regexp on your pattern.
    See also Wildcard Characters in SQL Server

  • πŸ‡­πŸ‡°Hong Kong BassPlaya

    @goodboy it's working now. Thanks!

    I'd like to mention that I now have autoban_cron running every 10 minutes and I guess that was the thing. It was in "cron mode" but the autoban_cron never ran (Elysia cron) and therefore never banned them.

Production build 0.69.0 2024