.php cgi-bin admin images search includes .html cache wp-admin plugins modules wp-includes login themes templates index js xmlrpc wp-content media tmp language scripts user install css register feed ...
When you use CRS or DRS 2.1 and later, your WAF is configured to use anomaly scoring by default. Traffic that matches any rule isn't immediately blocked, even when your WAF is in prevention mode.