Hi @renemorozowich,
Thank you for reaching out to us. Please accept our apologies for the delayed response.
Wordfence determines the IP addresses of all site visitors in order to provide security functions on your site. Real-time information about what is happening on your site can be viewed on the Wordfence “Live Traffic” page which automatically updates as new visitors access your site. You can filter the live traffic using the “Locked Out”, “Blocked”, or “Logins and Logouts” filters and expand entries using the “eye” icon. This will usually explain more about the traffic and why Wordfence took the actions it did.
On blocking, Wordfence captures IP addresses blocked for breaking brute force or suspicious login rules. These IP addresses are listed in the Current blocks section under the Blocking tab on the Firewall page. All Blocked IP addresses can be exported from the Current blocks section, then clicking on the “Export All IPs” button at the top of the list of blocked IP addresses.
Additionally, it is crucial to make sure that Wordfence is detecting the visitors’ IP addresses correctly. While the Wordfence default configuration works automatically for most sites, it is important that this configuration is correct for your site. To confirm, navigate to Wordfence > Dashboard > Global Options > General Wordfence Options > How does Wordfence get IPs and go through the options there until it displays your current IP address as shown on https://whatsmyip.com/. Once done, be sure to click the SAVE button to save the settings.
I hope this answers your question. If you have further questions, please reach out to us and we will be happy to help.
Thanks,
Janet.
