Customizing Filter Suspicious Queries rules
Filter Suspicious Queries (the free 8G-based layer) exposes several filter hooks. Add a pattern, remove one named rule, or return an empty array to disable a category.
Setup guide: Filter Suspicious Queries.
Each list is an associative array: rule name, then the regular expression. You can unset one key and leave the rest of the protection on.
add_filter('query_string_items', function($items) {
unset($items['path_traversal']);
return $items;
});The same keys exist on request_uri_items, user_agent_items, and referrer_items. Appending with $items[] still adds a new pattern. Prefer a named key when you want to remove that pattern later.
Return true from wf_sn_cf_skip_bad_query_check to skip the whole query filter for that request. Use that only when you mean to skip it for good, not as a one-off exception. See below.
WordPress hooks vs Early Firewall
On the normal firewall these filters run on each request. You can change the list only when a certain query argument is present, and the next request is evaluated again.
Early Firewall compiles the same filters into its config. That happens when you enable Early Firewall, when you save Firewall settings, and after a plugin update. The compiled list is then used for every visitor. A callback that returns a different list only when $_GET['some_flag'] is set can bake that return value in for everyone, if a save or a ban happens to run on a matching request.
For Early Firewall, change rules in a fixed way (unset a key, or add a pattern that should always apply), then save Firewall settings or click Verify so the config rebuilds. Do not put request-only conditions in these filters if Early Firewall is on.
Payment and webhook URLs for an active WooCommerce or SureCart store already skip a fixed set of query rules at decision time. You do not need these filters for that. See store protection.
Request URI items
add_filter('request_uri_items', function($items) {
$items[] = '\.(exe|bin)$'; // Blocks .exe and .bin file accesses
return $items;
});Query string items
add_filter('query_string_items', function($items) {
$items[] = 'admin(\s|%20)console'; // Blocks attempts to access admin consoles
return $items;
});Referrer items
add_filter('referrer_items', function($items) {
$items[] = 'badreferrer\.com';
return $items;
});Blocked hosts list
Hostname matching is off by default. Enable it with secnin_cf_check_blocked_hosts before this list has any effect:
add_filter('blocked_hosts_items', function($items) {
$items[] = 'examplemalicioushost.com';
return $items;
});Test on staging first. Overly broad rules can block legitimate traffic.
Disabling a category
Return an empty array for a filter to skip that category. Other Filter Suspicious Queries checks still run if the main toggle is on.
Request URI
add_filter('request_uri_items', function($items) {
return []; // Disables all Request URI checks
});Query string
add_filter('query_string_items', function($items) {
return []; // Disables all Query String checks
});Referrer
add_filter('referrer_items', function($items) {
return []; // Disables all Referrer checks
});Blocked hosts
add_filter('blocked_hosts_items', function($items) {
return []; // Disables hostname list entries (only when hostname checks are enabled)
});Warning: Disabling a filter reduces protection for that category. Keep Filter Suspicious Queries on and only disable what you have verified causes false positives.
