Customizing Filter Suspicious Queries rules
Filter Suspicious Queries (the free 8G-based layer) exposes several filter hooks. Add patterns, or return an empty array to disable a category.
Setup guide: Filter Suspicious Queries.
Request URI items
add_filter('request_uri_items', function($items) {
$items[] = '\.(exe|bin)$'; // Blocks .exe and .bin file accesses
return $items;
});Query string items
add_filter('query_string_items', function($items) {
$items[] = 'admin(\s|%20)console'; // Blocks attempts to access admin consoles
return $items;
});Referrer items
add_filter('referrer_items', function($items) {
$items[] = 'badreferrer\.com';
return $items;
});Blocked hosts list
Hostname matching is off by default. Enable it with secnin_cf_check_blocked_hosts before this list has any effect:
add_filter('blocked_hosts_items', function($items) {
$items[] = 'examplemalicioushost.com';
return $items;
});Test on staging first. Overly broad rules can block legitimate traffic.
Disabling a category
Return an empty array for a filter to skip that category. Other Filter Suspicious Queries checks still run if the main toggle is on.
Request URI
add_filter('request_uri_items', function($items) {
return []; // Disables all Request URI checks
});Query string
add_filter('query_string_items', function($items) {
return []; // Disables all Query String checks
});Referrer
add_filter('referrer_items', function($items) {
return []; // Disables all Referrer checks
});Blocked hosts
add_filter('blocked_hosts_items', function($items) {
return []; // Disables hostname list entries (only when hostname checks are enabled)
});Warning: Disabling a filter reduces protection for that category. Keep Filter Suspicious Queries on and only disable what you have verified causes false positives.
