Wordfence block ip on accessed url

psypat
(@psypat)

8 months, 1 week ago

In wordpress, you can block a user if they are visiting a specific url, or with a wildcard url.

I have created a honeypot, where if somebody visits a special page, they are redirected to another page, that are a banned url, in wordfence, and that page are sending them to…. somewhere..

It all seems to be working, they are being sent to hell, but wordfence isn’t banning the ip of the visitor..

Can someone explain why? – it seems in the live log that wordfence isn’t even registering the new page accessed by the visitor..

Viewing 7 replies - 1 through 7 (of 7 total)

Plugin Support wfmark
(@wfmark)

8 months, 1 week ago

Hi @psypat, thank you for reaching out.

Have you added the URLs to the “Immediately block IPs that access these URLs“ section under Wordfence > All Options > Advanced Firewall Options ?

If so, can you please share a screenshot of the URLs and send me a diagnostic report so that I can test that by accessing the URLs.

You can send the diagnostic report to wftest@wordfence.com directly using the link at the top of the Wordfence > Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,

Mark.

Thread Starter psypat
(@psypat)

8 months ago

Hi @wfmark , Ive sent it..

This is only a test site, where I was just testing this function.

The url for accessing the honeypot is https://gr1.gr1.se/wp-admin/admin.php?

and that would redirect you to https://gr1.gr1.se/test, and if you access that page, you would be banned, so direct access is working, but not if the visitor is being redirected there

Thread Starter psypat
(@psypat)

8 months ago

ping?

Plugin Support wfmark
(@wfmark)

7 months, 4 weeks ago

Hi @psypat,

Thank you for sharing the URLs.

Looks like the redirect is not working as expected. The URL https://gr1.gr1.se/wp-admin/admin.php redirects to banned.se not https://gr1.gr1.se/test.

When I accessed https://gr1.gr1.se/test, I was blocked immediately by Wordfence for Accessing a banned URL.

Thanks,

Mark.

Thread Starter psypat
(@psypat)

7 months, 3 weeks ago

Hi @wfmark

when you’re accessing https://gr1.gr1.se/wp-admin/admin.php you are redirected to https://gr1.gr1.se/test/index.php

and there you are redirected to https://banned.se

Plugin Support wfmark
(@wfmark)

7 months ago

Hi @psypat,

Apologies for the delayed response.

It looks like the redirects happen before Wordfence blocks the URL.

So when the user is redirected to https://banned.se, the block won’t take effect.

Thanks,
Mark.

Thread Starter psypat
(@psypat)

7 months ago

Hi @wfmark!

I’ve added a delay with 2 seconds, but wordfence is still ignoring it…

Can it be so that wordfence is ignoring a banned url if a user is redirected to that directory via the website?.. If the referrer is “legal”, eg my own page, wordpress is ignoring it?

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Wordfence block ip on accessed url’ is closed to new replies.

Tags