Blocking wordpress posting page or edit page

[Meshuggah2018]

Hi I noticed the Browser extensions, blocked my own site when I chose edit a page, then next day on create a post, blocked. didn't block the site when I logged on. or visited the wp-admin url. 

and today off twitter clicked an article from associated press, site was apnews.com and browser extension blocked it.   

[Meshuggah2018]

another WP site when I wanted to edit a page must be the /post.php? triggers? just a guess

 

Website blocked: http://maine-stripper.com/wp-admin/post.php?post=4&action=edit

[Meshuggah2018]

another wp site:/ wp-admin/post.php?post=8&action=edit is blocked 

 

so post.php? is the culprit?????

[rakka]

https://wordpress.org/ is part of the whitelist and is not blocked. 

what do you see on the block page? and the URL? 

[Meshuggah2018]

I have around 20 WP sites, on my own domains. and when I try to edit a page wp-admin/post.php?post=15&action=edit  It get's blocked.  The alert happens after I log in and click page or post, edit. then the warning page arrives.

[Meshuggah2018]

On 9/4/2018 at 8:03 PM, rakeshsejwal said:

https://wordpress.org/ is part of the whitelist and is not blocked. 

what do you see on the block page? and the URL? 

I'm talking about my own domain. here's screenshot of the warning

[rakka]

are you using any coin mining tags from wordpress on your site? https://wordpress.org/plugins/tags/mining/

[Meshuggah2018]

4 minutes ago, rakeshsejwal said:

are you using any coin mining tags from wordpress on your site? https://wordpress.org/plugins/tags/mining/

Absolutely not, And its on every one of my domains using wp, when I click edit page or post. thinking i'm mining. I am assuming between clicking edit and the extenstion checking new url it thinks it's mining

[rakka]

I have whitelisted your site to see if that fixes the above issue or not. 

please try again in couple of hours. 

Thanks for your patiences 

[Meshuggah2018]

52 minutes ago, rakeshsejwal said:

I have whitelisted your site to see if that fixes the above issue or not. 

please try again in couple of hours. 

Thanks for your patiences 

Thanks but my site to customers, (non wp-admin access) don't get pop up from the extension. it only happens when a wordpress customer clicks EDIT a page or EDIT a post.

that's what you have to fix.

[rakka]

ok

can you please follow below steps and get me the console logs? 

1.    Open a Chrome browser
2.    Click on the hamburger menu icon (3 dots)
3.    Click on More Tools
4.    Click on Developer Tools
5.    Click on the Settings icon to open and close the settings options 
6.    Select Preserve log
7.    Select Show timestamps
8.    Click on the circle icon on the left side of the console panel
9.    The log will be cleared
10.     Revisit the site in question or try to reproduce the issue
11.     Copy the log from console and save it to a text file 
12.     Zip it and PM me the logs

[Meshuggah2018]

That's what I see before you popup. 

[rakka]

I just published a new package on Chrome store, 1.0.28

can you please try it again? there are some minor detection changes in it. 

 

for the logs above, can you go all the way down till you see coin mining in the logs? 

 

Thanks

[Meshuggah2018]

I don't see that i'm cropping screenshot of posts page then edit page which then goes to your malware extension warning.

[Meshuggah2018]

I guess does anyone else have a site with wordpress installed and try editing a post or editing a page with the malwarebytes chrome extension enabled?

[Mickey76]

Yes- I have this problem just now. I am using Firefox (build ver: 65.0.1 with the Malwarebytes browser extension added ) I can log in no problem, but as soon as I go to edit a page  I get a pop-up window (attached) and the "Website blocked: https://factoryofthefuture.org/wp-admin/post.php?post=120&action=edit"    Additional information, this does not happen in Safar or, Chrome as the browser extension is not installed there.

[Mickey76]

Also see this when hovering over the browser tab:(see attached)

[Meshuggah2018]

I've uninstalled the malwarebytes extension. 

[Mickey76]

I did as well - Thanks for your help.

[rakka]

Unfortunately I am not able to replicate the issue here, but I have added https://factoryofthefuture.org to the whitelist anyway.