Support » Plugin: Wordfence Security - Firewall & Malware Scan » blocked by the Wordfence Security Network?

  • Resolved webtica

    (@webtica)


    Hey ,

    I had three small questions about the live traffic section and firewall.

    1. When i login to my site and look at the live traffic view i get alot of ip’s that say blocked by the Wordfence Security Network. I had one for example 19 minutes ago and one 50 min ago. the one that is 50 minutes ago says click here to unblock ( so this one is blocked? ) and the one 19 minutes ago says click here to block ( not blocked ? ) are they still both blocked? they both give the red mark with “blocked by the Wordfence Security Network”.

    2. As following of first question, when i look at ip’s blocked from accessing the site they are only blocked for 30 minutes when in options I entered 6 hours. also they are only the ones i manually blocked? not the ip’s blocked by the Wordfence Security Network?

    3. Should I permanently block those ip’s ?

    Thanks
    Dieter

Viewing 11 replies - 1 through 11 (of 11 total)
  • Thread Starter webtica

    (@webtica)

    Anyone? i asked these questions before also then no one answered.

    Hi Dieter,
    – As long as you have “Participate in the Real-Time WordPress Security Network” option enabled, then you might see some visits got “Blocked by Wordfence Security Network” if their IPs were currently engaged in malicious activity.
    – These IPs will be blocked for the amount of time set in “How long is an IP address blocked when it breaks a rule” which is 5 minutes by default.
    – You should see these IPs listed in (Wordfence > Blocking => Blocked IPs) during this time.
    – Also during this period of time, these entries in “Live Traffic” log should have this button with “Unblock this IP” as they are already blocked, and when the time run out, the link should be toggled to “Block this IP”.
    – It’s not recommended to block IPs permanently as they are known to be dynamically assigned to different devices, so some of these IPs could be legit at some point and you will be blocking them by mistake.

    With that said, could you please double check if these IPs got listed in “Wordfence > Blocked” once they are blocked or not? and you should be able to see something like “Will be unblocked in 2 min” there too.

    Thanks.

    Thread Starter webtica

    (@webtica)

    Hi!

    Thanks for all the info.
    I have a site for example where in options “How long is an IP address blocked when it breaks a rule ” at 30min.
    and login block time 12 hours.

    But when i look at live traffic i have an ip that is blocked by the Wordfence Security Network at https://domain/wp-login.php It is marked in red but i have the button option to block the ip. this is 17 minutes ago. also when i go look at blocked page the ip is not there. is this normal? since i put in options page 30 minutes.

    The ones that are blocked trying to login where i get a mail from for example ‘”IP” tried to login using username ….”‘ these ones are in blocked section ip’s locked out from login these ones are blocked for 12 hours so these ones are okay.

    But the other ones blocked by wordfence network i don’t quite understand. are these also trying to login? or are these ip’s that tried loggin in at different sites and got blocked that now tries accessing the lgoin page?

    Sorry for this.
    Thanks!
    Dieter

    It could be that this IP was blocked initially before that attempt you saw in the Live Traffic, I mean this wasn’t the first attempt, that’s why it seems to be unblocked earlier than what was expected.

    Yes, these IPs were involved in malicious attacks on other websites at this specific time, so they got blocked when trying to access your login page, initializing a brute force attack on login page is a very common type of attacks.

    Thanks.

    Thread Starter webtica

    (@webtica)

    Oh okay I see so for example if IP xx.xx.xx.xx get flagged and blocked for 30 min and it tries again after 28 min then after those 2 minutes left it will get unblocked again yes? so after that full 30 min if it tries again it will get blocked again for 30 min.

    Thanks for the info this clarifies things.

    I will put the block time at 6 hours just to see.

    Thanks
    Dieter

    Yes, exactly.

    Thread Starter webtica

    (@webtica)

    Thanks!

    Just one last question.
    As i run multiple sites 20+ with wordfence. I can’t check live traffic all the time. but now i know how it works can i disable live traffic ? will wordfence then still block everything it is supposed to ? will this also help free server resources?

    Thanks
    Dieter

    It’s up to you actually, “Live Traffic” can be disabled from the plugin options page by unchecking “Enable Live Traffic View”, and you should know that login and firewall activity will still appear in the live traffic log, and the plugin will continue blocking malicious requests as expected.

    And yes, theoretically it should lower load on the server but I’m not sure if this can be noticed in practice or not. (it depends on your server setup).

    Thanks.

    Thread Starter webtica

    (@webtica)

    Well if it is not noticed I can just leave it on.
    Thanks for all the help and good info.

    Oh where can I drop a feature request?
    What would be cool to see is as i run multiple wordpress sites 20+
    it would be so handy to have a dashboard or 1 parent wordfence install with all my clients sites as child installs so when i change options it changes on all the other sites aswell. that would be so handy. I can’t imagine editing 100 sites there options.
    I do use the import and export options. That is already quite handy!

    Thanks!
    Dieter

    You are welcome to post features requests here in the forums, regarding the situation you described I think running these WordPress sites as a Network could be even more handy, because you will have to install Wordfence on the main Network dashboard not on every site in the network.

    Thanks.

    Thread Starter webtica

    (@webtica)

    Thanks!
    Wil look into this.

    Thanks for all the info.

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘blocked by the Wordfence Security Network?’ is closed to new replies.