WordPress.org

Ready to get started?Download WordPress

Forums

Wordfence Security
[resolved] I get multiple (8 emails) notifications of the same attacking IP (8 posts)

  1. szepe.viktor
    Member
    Posted 6 months ago #

    Please develop a locking mechanism to prevent multiple emails on a simgle attack.
    Thank you!

    https://wordpress.org/plugins/wordfence/

  2. Wordfence
    Member
    Plugin Author

    Posted 6 months ago #

    This was fixed in 4.0.3. Please see the changelog: (bottom of the 4.0.3 list)

    http://wordpress.org/plugins/wordfence/changelog/

    What are you seeing?

    Regards,

    Mark.

  3. szepe.viktor
    Member
    Posted 6 months ago #

    Thank you!

    I also have 4.0.3 running. It has just sent 8 emails of the same IP.
    How can I help you?

  4. 253david
    Member
    Posted 6 months ago #

    Does this mean the fix in 4.03 did not fix the problem? My solution was to uncheck "Alert when someone is locked out from login". Do you really need to know? If you think you do then extend the lockout period to anything up to 60 days and then be sure to check to see who is locked out before the period expires.

  5. Wordfence
    Member
    Plugin Author

    Posted 6 months ago #

    Hi Szepe,

    Please post the contents of the emails if they're all the same and I'll investigate. You can remove any personally identifying info from the email.

    Regards,

    Mark.

  6. szepe.viktor
    Member
    Posted 6 months ago #

    This alert was generated by Wordfence on "Fire Box Kft. Munkavédelem, Tűzvédelem és Környezetvédelem " at Wednesday 19th of February 2014 at 11:20:36 PM
    The Wordfence administrative URL for this site is: http://firebox.hu/wp-admin/admin.php?page=Wordfence

    Wordfence has blocked IP address 91.236.75.25.
    The reason is: "Exceeded the maximum number of page not found errors per minute for humans.".
    User IP: 91.236.75.25

    --
    To change your alert options for Wordfence, visit:
    http://firebox.hu/wp-admin/admin.php?page=WordfenceSecOpt
    To see current Wordfence alerts, visit:
    http://firebox.hu/wp-admin/admin.php?page=Wordfence

  7. szepe.viktor
    Member
    Posted 6 months ago #

    These (all 8) are fresh ones.
    Only the time (seconds) is different: 36 and 37

  8. Wordfence
    Member
    Plugin Author

    Posted 6 months ago #

    Perfect, thanks. I found the culprit and it's because for that particular block, first we send you the email, then we actually block the IP. So if a bad bot is accessing your site very quickly, you'll get multiple emails before the blocking code executes.

    Changed the order and that'll fix it. New code will be in the next release out within a week.

    Thanks,

    Mark.

Reply

You must log in to post.

About this Plugin

About this Topic