Whitelisted in Learning mode … overwhelming

  • Resolved Sue

    (@suelaren)


    8 years ago

    Is there a quick way to “select all” and delete or UN-Whitelist several items that were whitelisted during Learning Mode at one time? After running the Firewall for 24 hours, I have one site in particular that has 48 whitelisted entries, all from the same IP, all bogus (fake google crawler). How do I get them off the whitelist other than one at a time, with the “Save settings” pop up after every single one? (I get this whether I uncheck or try the delete button)

    I anticipate by tomorrow I will have this replicated on several sites – there has to be a way to select and apply to more than one entry at a time!!

    https://wordpress.org/plugins/wordfence/

Viewing 5 replies - 1 through 5 (of 5 total)
  • Thread Starter Sue

    (@suelaren)

    8 years ago

    Follow up – another site I manage also had 48 whitelisted entries, from the same IP address, similar in nature in the requests. The two sites are on different hosts (AlphaOmega Hosting, and 1and1 hosting) – I have blocked that IP in WordFence. I really need a way to handle the whitelisted entries more efficiently!

    Plugin Author WFMattR

    (@wfmattr)

    8 years ago

    Hi Sue,

    We will be adding a bulk select to the whitelist soon, to make it easier to remove these entries. Thanks for the input and the details!

    -Matt R

    Thread Starter Sue

    (@suelaren)

    8 years ago

    Thanks, Matt. As I understand it, both unchecking the whitelist entry, or deleting it from the list, perform the same function which is un-whitelisting the entry. The uncheck is temporary and can be reversed by re-checking it – does deleting it “blacklist” the IP? Or could that IP try again? Would those entries reappear if the attack was repeated?

    Plugin Author WFMattR

    (@wfmattr)

    8 years ago

    Hi Sue,

    That’s correct that unchecking it it almost the same as deleting it, except that you can bring it back again if needed. (This is in case you need to test a whitelisting rule, but most people will not need to.) Currently, IPs can’t be blacklisted from whitelisting during learning mode, but that may be something we can implement in a future version, or blacklisting a URL/parameter to prevent it from being whitelisted again — most attacks will come in bursts, so it’s unlikely (but not impossible) for the same IP to try again.

    There are more details on using Learning Mode here, if you are interested:
    https://docs.wordfence.com/en/Web_Application_Firewall_-_How_to_use_Learning_Mode

    -Matt R

    Thread Starter Sue

    (@suelaren)

    8 years ago

    Thanks for the helpful info, Matt. I’m seeing the same IP addresses on multiple sites, whitelisted while in learning mode, and I am blocking them manually with WordFence. I’m looking forward to the bulk edit feature to be added…

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Whitelisted in Learning mode … overwhelming’ is closed to new replies.