Hi @nadavlevy,
Thanks for reaching out!
The weekly summary email reports all blocking activity that occurred during the reporting period, including temporary blocks that have since expired. When an IP address breaks a firewall rule (like too many login attempts or excessive page requests), Wordfence temporarily blocks that IP for a set duration. Once that time passes, the block expires and is no longer visible on the Blocking tab.
Regarding the “United States” you’re seeing in the report: this refers to the geographic location of the IP addresses that were blocked, not a country blocking setting. Wordfence uses geolocation data to show where blocked traffic originated from. It means some of the blocked IPs happened to be from the USA.
The Blocking tab under Wordfence > Firewall > Blocking only shows current blocks, either permanent blocks you’ve manually added or temporary blocks that haven’t yet expired. Since most automatic blocks are temporary, they’ll naturally disappear from this list after they expire.
Let me know if you have any questions!
Thanks,
Margaret