Exceptions

The Exceptions tab configures which requests and components are exempt from specific firewall checks. Proper exception configuration is essential to prevent legitimate site functionality from being blocked.

JOOMLA

Exceptions are defined per component. All components installed on your site appear in the drop-down at the top of the section. To exclude a component from a specific filter, write its name in the corresponding text box. Multiple values can be entered separated by commas.

Global Setting

Option Description
Exclude Exceptions if Vulnerable When enabled, exception rules for a component are automatically suspended if that component appears in the vulnerability database as confirmed vulnerable. This prevents attackers from exploiting a vulnerable extension through the exception.

Sub-tabs

Base64

Option Description
Check Base64 When enabled, the firewall decodes Base64-encoded request parameters and inspects the decoded content for attack patterns.
Base64 Exceptions Components or URL patterns (one per line) that are excluded from Base64 decoding and inspection.

XSS

Option Description
Strip All Tags When enabled, HTML tags are stripped from request parameters before inspection, in addition to the XSS pattern filters.
Tags to Filter Comma-separated list of HTML tags that are not allowed in request parameters (e.g. script,iframe,object).
XSS Exceptions Components (one per line) excluded from the Strip All Tags filter. Add components that legitimately need to pass HTML or script tags in their parameters.

SQL Injection

This sub-tab groups exceptions for six independent SQL injection filters. Each is a components list (one per line) where that specific filter does not apply:

Filter What it checks
Duplicate Backslashes Prevents duplicated backslashes in a request parameter.
Line Comments Prevents SQL line-comment sequences (--, #) in a request parameter.
SQL Pattern Checks a request parameter for common SQL injection patterns.
If Statement Checks a request parameter for SQL IF statements.
Using Integers Checks a request parameter for hexadecimal integer values (0x...).
Escape Strings Adds a backslash before \x00, \n, \r, \, and \x1a.

LFI Exceptions

A list of components excluded from LFI (path traversal) pattern matching.

CMD Injection Exceptions

A list of components excluded from command injection pattern matching (available since version 5.2.0). Exceptions for this filter can also be added directly from the View Logs page when reviewing a false positive.

Second Level Exceptions

A list of components excluded from the Second Level filter, which flags a request as a hacking attempt when it contains two or more suspicious keywords (e.g. drop, admin).

You can completely disable any filter by adding a * character as an exception. Use this only as a last resort for troubleshooting — it removes all protection for that filter type.

Web Firewall Configuration - Exceptions tab with per-component filter exclusions (Joomla)

WORDPRESS

In WordPress, exceptions are defined by URL rather than by component name. To find the URL involved in a false positive, check the firewall logs — the URL involved column shows the exact path that triggered the block:

Firewall log entry showing the URL involved column (WordPress)

Once you have the URL, go to the relevant filter tab (e.g. XSS) and add it there:

Adding a URL exception to the XSS filter tab (WordPress)

You can completely disable any filter in WordPress by adding a * character as an exception.