Support » Plugin: Wordfence Security - Firewall & Malware Scan » BUG REPORT – email msg for each “blocked” entry – same IP???

  • Resolved bluebearmedia

    (@bluebearmedia)


    Only since yesterday’s update… every block notification is resulting in an email message???

    I just received 16 “IP blocked” messages for the same IP address (within seconds of each other…), in a row…

    Something change?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Sorry – more details…

    The block that generated multiple emails was on “Exceeded the maximum global requests per minute for crawlers or humans”… other types of blocks didn’t generate emails.

    Plugin Author WFMattR

    (@wfmattr)

    Hi,

    Thanks for the report. This can happen for very fast attacks from a single IP that are being processed at the same time — it can be hard to avoid completely since visits can happen in parallel. (It might also happen more with hosts that have multiple database servers with replication, since that adds some latency.)

    So for example, if the limit was set to 20 in this case, it’s possible that visits 21, 22, 23, and so on were happening so close together, that more than one of them read that the count of visits from this IP was still at 20 — and visit #21 wasn’t finished blocking the IP before visits #22 and #23 occurred.

    Here is a simplified example with 3 visits at the same time (right as the limit of 20 was hit):
    #21 connects
    #22 connects
    #21 reads the number of past visits (20)
    #23 connects
    #22 reads the number of past visits (20)
    #23 reads the number of past visits (20)
    #21 blocks the IP and sends an email
    #22 blocks the IP and sends an email
    #21 shows the visitor a ‘blocked’ page
    #23 blocks the IP and sends an email
    #22 shows the visitor a ‘blocked’ page
    #23 shows the visitor a ‘blocked’ page

    That being said, we’ll keep an eye out if this seems to increase more. We might be able to rearrange it so the counting happens closer together, to limit the amount of overlap between multiple hits from the same IP.

    -Matt R

    OK – thanks for the info, Matt!

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘BUG REPORT – email msg for each “blocked” entry – same IP???’ is closed to new replies.