WordPress Web Attack Audit Log Dataset (ModSec-WP)

WordPress ModSecurity Attack Log Dataset (LightIDS) A labelled dataset of HTTP transactions captured from a live WordPress server instrumented with the ModSecurity web application firewall in detection-only mode. Each record is a single request/response transaction extracted from the ModSecurity native JSON audit log and annotated into six classes: SQL Injection, Cross-Site Scripting, File Inclusion (LFI/RFI/Path Traversal), Remote Code Execution, Brute Force, and Normal. The dataset is designed for training and evaluating machine-learning intrusion detection in WordPress environments, where plugin-exploitation signatures differ from those in general-purpose web-attack benchmarks. Content. The dataset contains labelled HTTP transactions collected from a live WordPress deployment protected by ModSecurity (OWASP Core Rule Set). Each row corresponds to one request/response transaction parsed from the ModSecurity native JSON audit log, together with a class label indicating whether the transaction is benign or which attack family it belongs to. Version 1 comprises 108,823 transactions across 26 columns; Version 2 comprises 108,883 transactions, extending Version 1 with 60 additional real file-inclusion examples (Directorist and character-encoded paths) used for coverage-gap remediation. Data is provided in Microsoft Excel (.xlsx), one transaction per row. Collection methodology. A controlled research testbed hosted a WordPress site behind Apache/Nginx with ModSecurity running in detection-only mode, so that every request was recorded in full without being blocked. Benign traffic and attacks (issued from a separate attacker machine against real, publicly disclosed WordPress plugin vulnerabilities) were replayed against the site. The ModSecurity audit log was parsed into tabular form, and the request body and response body were recovered from their respective audit sections and added as columns. Labelling. Each transaction was labelled using a hybrid procedure: (a) attack-scenario correlation via timestamps and execution traces, (b) regular-expression pattern matching on the request content, and (c) manual expert validation of ambiguous cases. The taxonomy contains six classes: sqli, xss, fileinclusion-ldf (aggregating LFI, RFI, and path traversal), rce (including malicious upload), bruteforce, and normal. Class distribution (Version 1). Class Records sqli 69,631 normal 12,597 xss 8,625 bruteforce 7,568 fileinclusion-ldf 6,230 rce 4,172 Total 108,823 The dataset is intentionally imbalanced to reflect real traffic, where SQL injection dominates. Because automated tooling issues many repeated requests, a substantial fraction of rows are near-identical; users are advised to adopt a de-duplicated or group-aware train/test split rather than a naive random split. Columns (26). Identity and network metadata (transaction_id, event_time, remote_address, request_host); request fields (request_useragent, request_line, request_line_method, request_line_url, request_line_protocol, request_body); response fields (response_protocol, response_status, response_body); ModSecurity rule-evaluation metadata (action, action_phase, action_message, message_type, message_description, message_rule_id, message_rule_file, message_msg, message_severity, message_accuracy, message_maturity, full_message_line); and the target label. Suggested feature set. Of the 26 columns, seven form the working feature set used in the reference model: request_useragent, request_line_method, request_line_url, request_body, response_status, response_body, and the target label. Textual fields are vectorised with TF-IDF and categorical fields with label encoding. The ModSecurity rule-evaluation columns are exogenous annotations and are not used as model inputs, but may support analysis or alternative labelling. Intended use. Training and evaluating supervised classifiers and anomaly detectors for WordPress web-attack detection directly from ModSecurity audit logs, and reproducing the LightIDS study pipeline (feature engineering, model comparison, live validation, and coverage-gap remediation). Provenance and ethics. Collected in an isolated research testbed; client identifiers are anonymised. All attacks were executed against the authors' own controlled system for defensive research purposes. Files. combined_final_dataset_new_label.xlsx — Version 1 (108,823 transactions) combined_final_dataset_augmented.xlsx — Version 2 (108,883 transactions)