I’m getting the same error regarding the WPADMIN-SBR.
[403 GET|HEAD Request: November 9, 2015 - 6:24 pm] Event Code: WPADMIN-SBR Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/ REMOTE_ADDR: 24.32.[my.IP] Host Name: 24-32-[my.IP] SERVER_PROTOCOL: HTTP/1.1 HTTP_CLIENT_IP: HTTP_FORWARDED: HTTP_X_FORWARDED_FOR: 24.32.[my.IP] HTTP_X_CLUSTER_CLIENT_IP: REQUEST_METHOD: POST HTTP_REFERER: http://www.sitename.com/wp-admin/user-edit.php?user_id=625&wp_http_referer=%2Fwp-admin%2Fusers.php%3Fs%3Dmelanie%26action%3D-1%26new_role%26bbp-new-role%26bbp-bulk-users-nonce%3Ddf340c5aca%26paged%3D1%26action2%3D-1 REQUEST_URI: /wp-admin/user-edit.php QUERY_STRING: HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
And I’ve already made an .htaccess exception and verified that it is in the wp-admin folder, although I have the feeling this wasn’t the correct action. (And I also whitelisted/allowed apostrophe’s / single quote code characters from the post above.)
RewriteCond %{REQUEST_URI} (user-edit\.php) [NC] RewriteRule . - [S=2]