ThreatShield is designed to protect your website from live attacks. When the RASP module identifies a web request that matches a known exploit pattern, it immediately intercepts the request and displays an Access Denied page to the visitor.
You can see an example of this protective screen here: Access Denied Page by Monarx.
When is it a False Positive?
Before reporting a block, it is important to distinguish between a successful security block and a false positive:
Expected Block: If a user is blocked while repeatedly attempting to access a login/registration page or submitting "code-like" snippets into a public comment section, ThreatShield is likely working as intended to prevent brute-force or injection attacks.
False Positive: If a legitimate user or administrator is blocked while performing a standard task—such as saving a page in a page builder (Elementor/Divi), updating a plugin, or submitting a complex contact form—this may be a false positive that requires triage.
Method 1: Via the Monarx Web App (Preferred)
This is the fastest and most accurate way to report a block. Reporting directly from the dashboard provides our researchers with the exact telemetry needed to adjust the detection engine.
Log in to the Monarx Dashboard.
Navigate to the RUNTIME menu on the left-hand sidebar.
Select the BLOCKED events tab to see a list of recent RASP interceptions.
Locate the event that corresponds to the time and IP of the blocked user.
Click the three dots menu (⋮) on the far right of that event row.
Select REPORT RASP EVENT AS FALSE POSITIVE.
Method 2: Manual Submission to Support
If you cannot locate the event in the dashboard or need manual triage, you can provide the details directly to our support team. Please include the following information:
The Target URL: The exact web address where the "Access Denied" page appeared.
The User’s IP Address: The IP address of the person who was blocked.
The Action Performed: A brief description of what was happening (e.g., "Updating the 'About Us' page via the WordPress editor").
The Timestamp: The approximate date and time the block occurred.
What Happens Next?
Once our support team receives these details, we will:
Analyze the Logs: We will locate the specific request in our RASP logs using your IP and URL.
Verify the Pattern: Our security researchers will determine if the "exploit pattern" triggered was a legitimate piece of code or administrative action.
Adjust the Engine: If verified as a false positive, we will update the ThreatShield logic globally to ensure this action is allowed moving forward.
Need Immediate Help?
If a critical site function is being blocked and you need urgent assistance, please reach out to our support team through the Monarx Dashboard. We are committed to ensuring your site remains both secure and fully operational.