WordPress.org

Support

Support » Plugins and Hacks » Wordfence Security » [Resolved] I get multiple (8 emails) notifications of the same attacking IP

[Resolved] I get multiple (8 emails) notifications of the same attacking IP

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Author Wordfence

    @mmaunder

    This was fixed in 4.0.3. Please see the changelog: (bottom of the 4.0.3 list)

    http://wordpress.org/plugins/wordfence/changelog/

    What are you seeing?

    Regards,

    Mark.

    Thank you!

    I also have 4.0.3 running. It has just sent 8 emails of the same IP.
    How can I help you?

    Does this mean the fix in 4.03 did not fix the problem? My solution was to uncheck “Alert when someone is locked out from login”. Do you really need to know? If you think you do then extend the lockout period to anything up to 60 days and then be sure to check to see who is locked out before the period expires.

    Plugin Author Wordfence

    @mmaunder

    Hi Szepe,

    Please post the contents of the emails if they’re all the same and I’ll investigate. You can remove any personally identifying info from the email.

    Regards,

    Mark.

    This alert was generated by Wordfence on “Fire Box Kft. Munkavédelem, Tűzvédelem és Környezetvédelem ” at Wednesday 19th of February 2014 at 11:20:36 PM
    The Wordfence administrative URL for this site is: http://firebox.hu/wp-admin/admin.php?page=Wordfence

    Wordfence has blocked IP address 91.236.75.25.
    The reason is: “Exceeded the maximum number of page not found errors per minute for humans.”.
    User IP: 91.236.75.25


    To change your alert options for Wordfence, visit:
    http://firebox.hu/wp-admin/admin.php?page=WordfenceSecOpt
    To see current Wordfence alerts, visit:
    http://firebox.hu/wp-admin/admin.php?page=Wordfence

    These (all 8) are fresh ones.
    Only the time (seconds) is different: 36 and 37

    Plugin Author Wordfence

    @mmaunder

    Perfect, thanks. I found the culprit and it’s because for that particular block, first we send you the email, then we actually block the IP. So if a bad bot is accessing your site very quickly, you’ll get multiple emails before the blocking code executes.

    Changed the order and that’ll fix it. New code will be in the next release out within a week.

    Thanks,

    Mark.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘[Resolved] I get multiple (8 emails) notifications of the same attacking IP’ is closed to new replies.
Skip to toolbar