How to Report a False Positive at Monarx

If Monarx has flagged something that shouldn't have been flagged, this article points you to the right process. "False positive" means different things depending on which Monarx service triggered it, and each one has its own reporting path. Use the sections below to find the type that matches what you're experiencing.

Which type of false positive am I seeing?

What's happening	Service involved	Section
A specific file was flagged as malware, but you believe it's safe	Server Antivirus	File Classification False Positives
A visitor or admin gets an HTTP 403 "Access Denied" error on a specific URL, page, or form submission	ThreatShield (RASP)	ThreatShield Access Denied False Positives
A visitor or an entire IP can't connect to the server at all, on any protocol (not just a blocked webpage)	SmartWAF	SmartWAF IP Blocking False Positives

File Classification False Positives

Service: Server Antivirus

This applies when our antivirus engine has scanned a file on your server and classified it as malicious, but you believe the file is legitimate and safe. You can submit the file directly for manual review, either through the public upload portal or from within the Monarx Dashboard's FILES module. Our team reviews submissions within one business day, and if the file is confirmed safe, the detection is cleared globally so it won't be misflagged again for you or other customers.

💡 For full step-by-step instructions, see How to Report a False Positive Classification on a File.

ThreatShield Access Denied False Positives

Service: ThreatShield (Runtime Application Self-Protection / RASP)

This applies when a legitimate visitor or administrator receives an HTTP 403 "Access Denied" error while performing a normal action on a website — for example, saving a page in a builder like Elementor or Divi, updating a plugin, or submitting a form. ThreatShield blocked the request because it matched a pattern associated with known exploit attempts, but in this case the action was legitimate. You can report the blocked event from the Monarx Dashboard's RUNTIME > BLOCKED events log, or submit the details (URL, IP address, action performed, and timestamp) directly to support. Our team reviews the triggering pattern and adjusts detection globally if it's confirmed as a false positive; changes typically propagate within 5–10 minutes.

💡 For full step-by-step instructions, see How to Report a ThreatShield False Positive (Access Denied).

SmartWAF IP Blocking False Positives

Service: SmartWAF (network-layer IP blocking)

This is a different kind of issue from the two above. SmartWAF operates at the network layer and blocks traffic based on IP reputation rules. When an IP address gets listed by one of these rules, that IP is blocked from connecting to the server entirely — not just over HTTP. Unlike a ThreatShield 403 (which blocks a specific request while the server otherwise remains reachable), a SmartWAF block means the visitor's IP cannot establish a connection to the server using any protocol.

If you believe an IP has been blocked incorrectly by SmartWAF, please note that self-service false positive reporting for SmartWAF is still in development and not yet available. This capability is coming soon. In the meantime, if you suspect a SmartWAF false positive, please reach out to our support team directly with the affected IP address, the approximate time of the connection attempt, and any relevant context, and we'll investigate manually.