Thanks. :)

If the mod is the same as it was before the reason this trigger occurs is this part of the query string:

"script" is one of the trigger words as this can be used to pass javascript on a querystring. So this causes the "firewall" to block and create the email.

I am getting false positives as well

I have had very little issue with this firewall so far, I may have to turn it off while in admin CP to access one or 2 things but nothing that has caused any issue.

Today I was looking at my logs and the firewall has blocked some very real attacks on my site from bots:

Info on this bot can be found here.

Thanks again for the firewall keep up the good work ;)

I have it running without issues on 374pl1. What are those things you refere to need the firewall disabled?

Cheers. :)

Edit: I was mistaken, thread subscription fails, interpetted as a hack attempt.

This addon just base on the keywords list which define in the plugin, so it may lead to wrong detection too. Just look in the code you will the all the list, such as:
So if you have your php code file name as these above list then you could not run :D . Any if a hacker read this, they 'll modified their backdoor to another filename such as "a.php" then this script is .. useless.

I'm on 3.7 but got two of these emails:

my logfile reads this

1||1228766931||||||||
1||1228767166||||||||

what does that mean?

Maybe IP Adresses :rolleyes:

Not likely... it's 10 digits, not 9.