# SPDX-License-Identifier: AGPL-3.0-only
# A browser working INSIDE a site's wp-admin: whatever the request and
# whatever the answer, its referer names a /wp-admin/ page. Gutenberg
# fires twenty REST calls in a second (a town hall's secretary crossed
# http-crawl's 20/20s, 2026-08-20), a plugin's endpoint may 403 on
# every call (WPML, same day, banned by http-probing) — the admin's own
# activity should argue FOR them. Meant as a NEGATIVE weight in rules
# that count rates or refusals; a scanner requesting /wp-admin/ paths
# sends no such referer and is untouched. A forged referer escapes
# those rules — the accepted residual (wp-scan-paths precedent): the
# content rules and the WAF-blocked instants still stand behind.
parser: wp-admin-referer
log: http
prefilter: "/wp-admin"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?[^ "]*)? [^"]*" \d{3} \S+ "[^"]*/wp-admin/[^"]*" '
time_field: time
time_format: nginx
