GridPane 7Grules v1.4runs in your browser
7G Firewall Exception Generator
Paste a 7G log line to see the rule group and the exact pattern that fired. 7G Helper then writes an exception for that one request shape, in the place GridPane keeps through its updates. The rest of the firewall stays on.
[21/Oct/2026:06:25:38 +0000] [":bad_request_15:"] 203.0.113.20 example.com "GET /wp-json/rankmath/v1/getHead?url=https://example.com HTTP/2.0" 403
bad_request_15Request URI rules
Matched https:// in the address. Rank Math’s SEO preview sends your own URL here: likely a false positive.
if ($bad_request_7g = $allow7g_rankmath_15) {
set $7g_drop_bad_request 0;
}How it works
From a 403 to a scoped fix in three steps
Copy the line
Every 7G block is logged on the server. To see the latest for one site, run:
tail /var/www/<site>/logs/7g.logSee the rule
You get the rule group and number, such as
bad_request_15, its pattern, and the part of the request it matched.Save the file
A file for
/var/www/<site>/nginx/turns off that one rule for that one address. Reload nginx, and twocurlchecks prove it.
What 7G checks
Five rule groups, each reading one part of the request
A block is one pattern, in one group, matching one part of one request. The log names the group and the number, so the fix can be that narrow too.
Request URI
26 rules$request_uri$bad_request_7g
Paths and file names scanners try: secrets files, backups, shells, odd characters.
Often blocks by mistake: Plugin routes that carry a URL, like Rank Math’s getHead.
Query string
38 rules$query_string$bad_querystring_7g
Injection patterns after the ?: SQL keywords, script tags, file paths.
Often blocks by mistake: OAuth sign-ins that redirect to localhost.
User agent
7 rules$http_user_agent$bad_bot_7g
Crawler names and script signatures in the user agent.
Often blocks by mistake: Link previews and SEO crawlers you actually want.
Referrer
3 rules$http_referer$bad_referer_7g
Known spam referrers and injection in the referring address.
Often blocks by mistake: Rare. GridPane sites can also have this group off.
Method
5 rules$request_method$not_allowed_method_7g
Request methods a WordPress site never needs, such as TRACE and CONNECT.
Often blocks by mistake: Almost never: it answers 405, not 403.
Questions
Before you save the file
Does the log line I paste leave my browser?
No. Matching runs in your browser against a bundled copy of GridPane’s rules, and nothing you paste is sent or stored. Fathom counts visits without cookies and never sees your log lines.
Will a GridPane update remove the file?
No. GridPane’s 7G config reads every *-7g-context.conf file in the site’s nginx folder and in /etc/nginx/extra.d, and updates leave them alone. See GridPane’s 7G guide (opens in a new tab).
Why not turn the rule group off?
Turning a group off drops every rule in it, for every request to the site. The exception drops one rule, for one address or one crawler, and only when that rule is what fired. Everything else 7G checks stays on.
The rule number is not in GridPane’s list. What does that mean?
It comes from a custom list on your server, which GridPane reads before its own rules. For a crawler, 7G Helper shows how to take its name off that list, which fixes every site on the server. The exception file works too, because it checks the number in your log.
A request got a 403, but there is no line in 7g.log.
Then 7G did not block it. A 403 can also come from Cloudflare, ModSecurity, Fail2Ban or a security plugin, and an exception here will not change those.
Is this made by GridPane, or by the author of 7G?
No. 7G is Jeff Starr’s firewall, published at Perishable Press (opens in a new tab). GridPane ships its own modified version. 7G Helper is an independent tool, so review each file before you use it.