diff --git a/par-api/src/main/java/com/par/api/controller/RiskRuleController.java b/par-api/src/main/java/com/par/api/controller/RiskRuleController.java
index 5534c59..449f263 100644
--- a/par-api/src/main/java/com/par/api/controller/RiskRuleController.java
+++ b/par-api/src/main/java/com/par/api/controller/RiskRuleController.java
@@ -21,14 +21,16 @@ public class RiskRuleController {
 
     @GetMapping("/api/v1/risk-rules/{siteType}")
     public ResponseEntity<?> getRules(@PathVariable String siteType,
-            @RequestParam(defaultValue = "0") int version,
+            @RequestParam(defaultValue = "0") String version,
             @RequestParam(defaultValue = "") String source) {
+        int ver;
+        try { ver = Integer.parseInt(version); } catch (NumberFormatException e) { ver = 0; }
         // 先尝试自定义规则
         int currentVer = riskRuleService.getVersion(siteType);
         Map<String, Object> data = riskRuleService.getRules(siteType);
         if (data != null) {
             data.put("source", "custom");
-            if (currentVer == version && "custom".equals(source)) return ResponseEntity.status(304).build();
+            if (currentVer == ver && "custom".equals(source)) return ResponseEntity.status(304).build();
             return ResponseEntity.ok(data);
         }
         // 回退默认模板
@@ -36,7 +38,7 @@ public class RiskRuleController {
         Map<String, Object> defData = riskRuleService.getRules("default:" + siteType);
         if (defData != null) {
             defData.put("source", "default");
-            if (defVer == version && "default".equals(source)) return ResponseEntity.status(304).build();
+            if (defVer == ver && "default".equals(source)) return ResponseEntity.status(304).build();
             return ResponseEntity.ok(defData);
         }
         return ResponseEntity.status(304).build();
diff --git a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
index 586bcce..3b9fe72 100644
--- a/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
+++ b/par-core/src/main/java/com/par/core/interceptor/HmacAuthInterceptor.java
@@ -46,6 +46,12 @@ public class HmacAuthInterceptor implements HandlerInterceptor {
 
     @Override
     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
+        // 只拦截写入操作（PUT/POST/DELETE/PATCH），GET/HEAD/OPTIONS 直接放行
+        String method = request.getMethod().toUpperCase();
+        if ("GET".equals(method) || "HEAD".equals(method) || "OPTIONS".equals(method)) {
+            return true;
+        }
+
         // 方式 1：Bearer Token
         String authHeader = request.getHeader("Authorization");
         if (authHeader != null && authHeader.startsWith("Bearer ")) {
diff --git a/par-core/src/main/java/com/par/core/service/impl/RiskRuleServiceImpl.java b/par-core/src/main/java/com/par/core/service/impl/RiskRuleServiceImpl.java
index f652ae2..cb7fce7 100644
--- a/par-core/src/main/java/com/par/core/service/impl/RiskRuleServiceImpl.java
+++ b/par-core/src/main/java/com/par/core/service/impl/RiskRuleServiceImpl.java
@@ -20,12 +20,19 @@ public class RiskRuleServiceImpl implements RiskRuleService {
     private final ManifestVersionService versionService;
     private final RiskRuleMapper mapper;
     private final com.par.core.storage.CachedStorageService storageService;
+    private final com.par.core.service.SiteService siteService;
     private static final ObjectMapper om = new ObjectMapper();
 
     private RiskRule findByIdentifier(String identifier) {
-        return mapper.selectOne(new com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper<RiskRule>()
+        // 先按 site_id 查找
+        RiskRule rr = mapper.selectOne(new com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper<RiskRule>()
                 .eq(RiskRule::getSiteId, identifier).eq(RiskRule::getDeleted, 0)
                 .orderByDesc(RiskRule::getId).last("limit 1"));
+        if (rr != null) return rr;
+        // 回退按 site_type 查找（兼容旧数据及 mediabot 按 site_type 查询）
+        return mapper.selectOne(new com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper<RiskRule>()
+                .eq(RiskRule::getSiteType, identifier).eq(RiskRule::getDeleted, 0)
+                .orderByDesc(RiskRule::getId).last("limit 1"));
     }
 
     @Override
@@ -58,7 +65,12 @@ public class RiskRuleServiceImpl implements RiskRuleService {
             String json = om.writerWithDefaultPrettyPrinter().writeValueAsString(rules);
             int nextVer = getVersion(siteType) + 1;
             RiskRule rr = new RiskRule();
-            rr.setSiteId(siteType);  // siteType param now carries the identifier (siteId)
+            rr.setSiteId(siteType);
+            // 从站点表查找 site_type，使 mediabot 可按 site_type 查询
+            var site = siteService.findBySiteId(siteType);
+            if (site != null && site.getSiteType() != null) {
+                rr.setSiteType(site.getSiteType().getValue());
+            }
             rr.setVersion(nextVer);
             rr.setRulesJson(json);
             mapper.insert(rr);