“Immediately block IPs that access these URLs ” not working

Hi @srd75, thanks for getting in touch about this.

All URLs in “Immediately block IPs that access these URLs” must start with a “/” without quotes and must be relative rather than containing the domain. That may be related to the differing results rather than the method used to access the site as Wordfence doesn’t treat VPN or Tor traffic differently.

If the path visited isn’t guaranteed, so could be /?utm_source... or /my-blog-post?utm_source... then you can add wildcards (*) too. An example of this might be:

/*?utm_source=xxx&utm_medium=email&utm_id=xxx

I’d advise you to exercise caution when doing this as anybody visiting a URL containing the precise string you specify will be blocked. If this query string is common to be added to your site links from search engines or mass email campaigns, you might inadvertently block legitimate visitors/customers from your site.

You can read more here: https://www.wordfence.com/help/?query=firewall-waf-option-immediately-block-urls

I hope that helps you out,
Peter.