WordPress WAF Logging and Evidence: See What the Firewall Recorded, Why It Acted, and What Needs Investigation
Aegisify WAF 1.20.13 uses a canonical WordPress database log for supported security and operational events, then maintains two protected line-oriented continuity mirrors. The Logs workspace adds filtering, deterministic severity, module attribution, charts, source inventory, aggregated keyword alerts, retention controls, and direct integration with Attack Story.
How a WAF Event Moves From Runtime Decision to Investigation
The current logging system separates its authoritative data source from continuity copies and investigation views so administrators know which source drives dashboards and decisions.
Click a stage to expand
01EventModule calls logger
02DatabaseCanonical evidence
03MirrorsTwo protected flat files
04ClassifyModule + severity
05InvestigateSearch + filter + charts
06EscalateAlerts + Attack Story
One Authoritative Database, Two Continuity Mirrors
The 1.20.13 Logs workspace explicitly identifies the data-source hierarchy instead of presenting three storage locations as equivalent sources.
Authoritative for Dashboards and Triage
The WordPress database table is the source used for dashboard aggregation, filtering, event triage, keyword alerts, and Attack Story. It is indexed by time, route, category, action, and IP for operational queries.
Protected Line-Oriented Continuity Copy
A secondary aegiswaf.log file is maintained under an Aegisify WAF uploads directory. It is a diagnostic mirror, not the canonical analytics database.
Shared Aegisify Logs Location
A second continuity file is maintained below wp-content/aegisify-logs/aegisify-waf, allowing WAF evidence to exist in the broader suite log structure.
Web Access Is Denied Where Supported
Aegisify creates index.php, Apache .htaccess denial, and IIS web.config authorization denial files in writable log directories. Server configuration still determines whether those controls are honored.
Turn Event Rows Into a Fast Operational Security View
The dashboard uses SQL aggregation over a configurable evidence window rather than trying to infer posture from a small page of recent rows.
All Events vs. Enforcement
Trend data separates the overall event stream from enforcement actions so teams can see whether activity growth reflects informational operations or actual blocks, challenges, and rate controls.
See Which Protection Layer Is Responding
Dashboard aggregation groups event categories into modules such as Core WAF, API & Application, Abuse & Bots, AI Security, DDoS & Rate Control, Access & Threat Intelligence, and administration/operations.
Deterministic Priority From Recorded Evidence
Blocked/denied actions are treated as Critical, challenges and rate limits as High, selected warnings or investigation actions as Medium, with lower-risk operational events below them unless event details provide an explicit supported severity.
Alert on Important Evidence Without Sending One Email Per Request
The current alert system has explicit aggregation and cooldown behavior.
Match Administrator Keywords
Alert rules use comma-separated terms matched against the assembled event line, including route, action, and details. Each rule has a title and can use explicit recipients or fall back to the WordPress administrator email.
Aggregate Repeated Lower-Severity Activity
The default alert qualification is three events in a 300-second window with a 1,800-second cooldown. Minimum events, aggregation window, and cooldown are bounded controls rather than unlimited email triggers.
Escalate Important Enforcement Faster
Critical/high severity or block, deny, challenge, and rate-limit actions are immediately eligible. Alert messages replace the raw IP occurrence in the event line with a short HMAC-derived source fingerprint and include event count and unique source-fingerprint count.
Control How Long WAF Evidence Stays in Each Storage Layer
Canonical database retention and flat-file retention are separate because the two storage layers have different operational jobs.
The database retention default is 30 days, configurable from 1 through 3,650 days. The protected flat-file mirrors default to 7 days, also bounded from 1 through 3,650 days. The administration page exposes a manual Retention Cleanup action, and the plugin schedules a daily retention hook for the database cleanup workflow where the feature is available.
Database deletion is batched to avoid one unbounded deletion operation. Flat-file cleanup rewrites the protected mirrors and removes lines older than the cutoff. Each flat file also has a 25 MB append ceiling; when the mirror reaches that size, the logger stops appending rather than letting a secondary diagnostic file grow without limit.
Use the Log as Part of a Security Loop
The value comes from connecting evidence to action rather than retaining rows indefinitely.
Turn WordPress Firewall Events Into Evidence You Can Search, Triage, and Act On
Use canonical event data, protected continuity mirrors, dashboards, filters, alerts, and Attack Story to understand what the WAF is actually doing.
Common Questions About Aegisify WAF Evidence
Are the flat files the source used by the dashboard?
No. The canonical WordPress database table is authoritative for dashboards, filtering, triage, alerts, and Attack Story. The two flat files are continuity mirrors.
Does Aegisify record every HTTP packet or full raw request?
No. It records structured application-security events created by supported WAF components. Event details vary, and the feature is not packet capture or a web-server access log replacement.
How are keyword alerts prevented from flooding email?
Lower-severity matches aggregate by alert/keyword/category/action and require the configured event count inside a time window. A cooldown suppresses repeated deliveries, while high-severity enforcement can qualify immediately.
Can administrators control log retention?
Yes. Database and protected flat-file retention have separate configurable day values, and the Logs page can run retention cleanup manually.
How can Aegisify AI help?
Ask about Aegisify or WordPress: errors, plugins, security, SEO, compatibility, troubleshooting, comparisons, or launch a free website scan.