False Positive SQL Injection

Hey @nicegamer7,

Wordfence does not block all SQL queries.

Can you please share screenshots of blocks in Wordfence > Live Traffic? Please share the expanded Details, this will give us a better idea of if they’re false positives or not.

Please let me know.

Thanks,

Gerroald

Hi @nicegamer7,

It is true that the query you wrote does nothing – however, it has the potential to reveal to the attacker that your site is susceptible to SQL injection.

For example, another type of attack, directory traversal is also blocked by Wordfence.

/?file=../../../some_file – even if some_file does not exist, your site could spit out a message that indicates that it is reading out sensitive files.

The point is to prevent the attacker from even being able to test if your site is vulnerable.

Dave