Security Threats Log Rule Codes Explained
Each entry in the Security Threats Log has a rule code, such as FW_URI_TRAILING_GARB. The code tells you which check stopped the request and where in the request WP Ghost found the problem. This page explains how to read the codes and lists the ones you’ll see most.
Where to find the rule code
Go to WP Ghost > Logs > Security Threats. Open the menu at the end of a row and click Threat Details. Code is the rule code, Area is the part of the request that matched, and Matched pattern is the rule itself. The Threat Type column groups the codes into plain categories such as SQL Injection Attacks or Cross-Site Scripting (XSS).
How to read a rule code
The first part says which WP Ghost check found the request. For firewall codes, the second part says where it was found.
| Part | Meaning |
|---|---|
FW_ | A firewall rule. The firewall level you picked decides which rules run. |
FW_GHOST_ | A request check of the 2026 Ghost Firewall: what the visitor sends in forms, uploads and cookies. |
THR_ | A threat the Security Threats Log recognized, such as a request for a PHP file that doesn’t exist. |
DET_ | A theme or CMS detector. |
BF_ | Brute force protection on the login. |
AI_BOT_UA | An AI crawler, when Block AI Crawler Bots is on. |
_QS_ | Found in the query string, the part of the URL after ?. |
_URI_ | Found in the URL path. |
_UA_ | Found in the user agent, the name a browser or bot sends. |
_REF_ | Found in the referrer, the page the visitor says they came from. |
Common rule codes
| Rule code | What it means |
|---|---|
FW_URI_TRAILING_GARB | The URL ends with a slash and a stray character, such as *, ", ', ., , or &. Scanners send URLs like this. A real visitor rarely does, unless they copied a broken link. |
FW_QS_UNION_SELECT / FW_QS_SQL_KEYWORDS_1 | The query string (the part of the URL after ?) holds UNION ... SELECT, the start of an SQL injection. |
FW_QS_SCRIPT_TAG | The query string holds a <script> tag, a cross-site scripting (XSS) attempt. |
FW_QS_EVENT_HANDLER | The query string holds an HTML tag with an event such as onload or onerror, another XSS pattern. |
FW_QS_JS_PROTOCOL | The query string holds javascript:, often encoded, to run script in the browser. |
FW_QS_TRAVERSAL_HEAVY | The query string climbs folders with ../ to reach files outside the site. |
FW_QS_ETC_PASSWD | The query string asks for /etc/passwd or /proc/self/environ, server files an attacker wants to read. |
FW_QS_WP_CONFIG | The query string points to wp-config.php, the file with your database password. |
FW_QS_BASE64_ENCODE | The query string calls base64_encode(), a way to hide code inside a request. |
FW_QS_FUNC_CALLS | The query string calls PHP or SQL functions such as exec(), fopen() or benchmark(). |
FW_QS_HEADER_INJECT | The query string tries to add an HTTP header or a cookie to the response. |
FW_QS_LONG_TOKEN / FW_UA_LONG_TOKEN | A single run of 2,000 or more letters and numbers in the query string or the user agent, typical of overflow and fuzzing tools. |
FW_UA_BAD_BOTS_1 to FW_UA_BAD_BOTS_10 | The user agent (the name a browser or bot sends) is on the list of bad bots. |
FW_UA_SCANNER_STACK | The user agent mixes odd characters with tool names such as wget, curl, python or nikto. |
FW_UA_SHELL_TOKENS | The user agent holds code words such as eval, base64_decode or bin/bash. |
FW_REF_SPAM_PHARMA_1 / _2 | The referrer (the page the visitor says they came from) holds spam words. |
FW_URI_DOTFILES | The URL asks for a hidden server file such as .htaccess, .htpasswd or .DS_Store. |
FW_URI_DB_CONFIG | The URL asks for a config file or a backup of one, such as wp-config.php.bak or db-config.txt. |
FW_URI_SHELL_FILES | The URL asks for a known web shell file name, the kind of file attackers leave behind on hacked sites. |
FW_URI_BAD_EXTS_1 to _3 | The URL ends with a file type a WordPress site doesn’t serve to visitors, such as .bak, .cfg or .aspx. |
FW_URI_ADMINER | The URL asks for a database admin script such as adminer.php. |
FW_URI_TIMTHUMB | The URL asks for timthumb.php or a similar thumbnail script with a known flaw. |
FW_URI_UPLOADERS | The URL asks for an upload script such as admin-upload.php or uploadify.php. |
FW_URI_WP_FAKE_FILES | The URL asks for a PHP file that looks like a WordPress file but isn’t one, such as wp-crons.php or wp-setups.php. |
FW_URI_OLD_STAGING | The URL is a bare folder such as /staging/ or /old-site/, where scanners look for forgotten copies of a site. |
FW_URI_FILENAME_BUCKET_1 to _9 / FW_URI_MARKERS_1 to _5 | The URL holds a file name or a marker from known attack tools. |
FW_GHOST_ROLE_ESCALATION | A visitor’s request tries to set a user role or capabilities, for example to make itself an administrator. 2026 Ghost Firewall. |
FW_GHOST_UPLOAD_PHP_SHELL | A visitor uploads a PHP file, or an image file with PHP code inside. 2026 Ghost Firewall. |
FW_GHOST_OBJECT_INJECTION | A parameter or cookie holds a serialized PHP object, used to run code through a plugin flaw. 2026 Ghost Firewall. |
FW_GHOST_SSRF | A parameter holds a cloud metadata address or a URL scheme such as gopher://, used to make your server call places it shouldn’t. 2026 Ghost Firewall. |
THR_URI_PHP_NONEXISTENT | Someone asked for a PHP file that doesn’t exist on your site, usually a scanner checking for a vulnerable plugin. |
THR_URI_PROHIBITED_ENV / _GIT / _README / _LICENSE | Someone asked for a file WP Ghost keeps private, such as .env, the .git folder, readme.html or license.txt. |
THR_QS_SQLI_SLEEP_FUNC / THR_QS_SQLI_TAUTOLOGY_1EQ1 | SQL injection tests in the query string: a SLEEP() call, or 1=1. |
DET_UA_HOST | The user agent belongs to a theme or CMS detector, blocked by Block Theme Detectors Crawlers. |
AI_BOT_UA | The user agent belongs to an AI crawler, blocked by Block AI Crawler Bots. |
BF_LOGIN_EXCEEDED | Too many failed logins from one IP address: brute force protection locked it out. |
What to do when a real visitor is blocked
Most entries are bots and scanners, and you don’t need to do anything. If a real visitor or one of your own tools was blocked, open the menu on that row:
- Whitelist Path lets that URL through.
- Whitelist Rule turns off only that rule code. The other rules keep working.
- Blacklist IP blocks the address if the entry is an attack you want to stop for good.
You manage everything you whitelisted in WP Ghost > Firewall > Whitelist. For the full log, see the Security Threats Log guide, and for the firewall levels, the 2026 Ghost Firewall guide.
Frequently asked questions
Is a rule code an error on my site?
No. A rule code means WP Ghost stopped a request. Your site keeps working for everyone else.
Why don’t I see a code from this list?
The list covers the codes you’ll see most. WP Ghost has more than 150 firewall rules, and each one has its own code. The Threat Type column always tells you the category.