On ?wordfence_syncAttackData

Hi @notjustshrawan, thanks for dropping us a message about this.

The wordfence_syncAttackData is a normal process run by Wordfence to ensure your malware signatures and rules are up-to-date with the latest ones we have released. In fact, the logs you’re seeing don’t appear to be error logs with warnings/errors, just records of POST requests made by your site unless some detail has been omitted from the message?

The ticket you reference was down to legitimate POST requests containing the wordfence_syncAttackData parameter being blocked by Wordfence itself and those blocks were appearing in Wordfence > Live Traffic. Unless you are also seeing these URLs in Live Traffic being blocked and have been experiencing problems with Wordfence updating, you shouldn’t need to allowlist your own site’s IP.

Thanks,

Peter.