Legit traffic — must NOT be refused
- Shop
- Product: Blue Widget — add to cart, leave a review
- Product: O'Brien's Coffee Beans — apostrophe in the name
- Cart
- Checkout — guest checkout, Cash on delivery — no payment
- My account — register / log in
- Contact form (Ninja Forms)
- Contact form (Contact Form 7)
- Post with open comments
- Search: "select the union of two sets"
- Search: O'Brien
- Login
Paste these into any text field (checkout notes, address, review, comment, contact message) — none may be refused, and none may execute:
Try SELECT * FROM posts WHERE id = 1 OR 1=1 -- and see my site shows 'Error 1=1' when I select a product <script>alert(1)</script> hello <img src=x onerror=alert(2)> O'Brien's Lane 12; ring bell (twice) <b>bold</b> and <a href="https://x.example">a link</a>
Attacks — MUST be refused (403)
Direct search with payloads (WordPress escapes these itself, so they are allowed — 200 — and that is correct):
- Search: ' OR 1=1– – — expect 200: WordPress escapes it
- Search: <script> — expect 200
The deliberately vulnerable probe plugin (interpolates the value into SQL without escaping):
- probe raw: ' OR 1=1– – — expect 403
- probe raw: ' UNION SELECT user_pass… — expect 403
- probe num: 1 AND SLEEP(5) — expect 403
- probe num: 1 — expect 200
- probe safe (prepare): ' OR 1=1– – — expect 200
- probe comment: <script> — expect 403 (or 200 defused with sql_xss_action=neutralise)
- probe comment: <img onerror> — expect 403
- probe comment: SQL tutorial text — expect 200, stored
- probe comment: O'Brien — expect 200, stored
Where to look: Security → Database log (Refused facet) and Firewall log. Your own address is on the allow list, so refusals do not strike it.