Second Level Detection
The Second Level tab configures the secondary keyword detection engine. Unlike the primary filters (XSS, SQL, LFI) which inspect parameter names and values for attack patterns, second level detection inspects the request body for a configurable list of suspicious words or phrases.
Options
| Option | Default | Description |
|---|---|---|
| Second Level | No | Enables the second level keyword detection engine. |
| Redirect if Pattern Found | (disabled) | When enabled, requests that trigger second level detection are redirected rather than just logged. |
| Limit Words | (number) | Maximum number of suspicious words that may appear in a single request before it is blocked. Setting this to 1 blocks any request containing a single forbidden word. Higher values tolerate more matches before blocking. |
| Words List | (textarea) | The list of forbidden words or phrases, one per line. The firewall checks whether any of these strings appear anywhere in the request body. |
Examples of suspicious words included by default: drop, admin, select, user, password, concat, login, load_file, ascii, char, union, from. Each word alone may be harmless, but several together in the same request can indicate an attack not covered by the primary filters.
Enabling Second Level Detection can increase false positives, especially on sites with rich content or search functionality. Tune the Limit Words threshold and review the default word list before enabling in production.
