Sentinel Troubleshooting

This guide covers common issues specific to Sera Sentinel security features.

False Positives (Legitimate Traffic Blocked)

Firewall Blocking Admin Actions

Cause: The WAF may block certain admin actions that look like attacks (e.g., saving posts with HTML, uploading files).

Fix:

1. Go to Sentinel > Firewall > Whitelist
2. Add your admin IP address to the whitelist
3. Or reduce the protection level from High to Medium

Firewall Blocking API Requests

Cause: REST API or AJAX requests may trigger WAF rules.

Fix:

1. Check the Sentinel > Firewall > Log for blocked requests
2. Identify the rule that triggered the block
3. Add an exception for the specific endpoint or request pattern

Locked Out of WordPress

Via Brute Force Protection

Cause: Too many failed login attempts from your IP.

Fix:

1. Wait for the lockout to expire (default: 30 minutes)
2. Or access your site via FTP and rename the sera-sentinel plugin folder to deactivate it
3. Log in and whitelist your IP address
4. Rename the folder back to reactivate Sentinel

Via Custom Login URL

Cause: You changed the login URL and forgot it.

Fix:

1. Access your site via FTP
2. Open wp-content/plugins/sera-sentinel/ and find the settings file
3. Or rename the plugin folder to deactivate Sentinel and restore the default login URL

Malware Scanner False Positives

Cause: Some legitimate plugins use code patterns that look suspicious (eval, base64_encode, obfuscated code).

Fix:

1. Review the flagged file in the diff viewer
2. If the file belongs to a trusted plugin, add it to the Scanner > Whitelist
3. If unsure, search for the file hash online to verify its legitimacy

Two-Factor Authentication Issues

Lost 2FA Device

Fix:

1. Use one of your backup codes to log in
2. Go to Sentinel > 2FA and reconfigure with your new device
3. If you have no backup codes, access the database and clear the 2FA settings for your user

2FA Not Accepting Codes

Cause: Time sync issue between your device and server.

Fix:

1. Ensure your phone's time is set to automatic
2. Check your server's time is accurate (date command in SSH)
3. Try using the next or previous code (30-second window)