IniLerm

Thank you so much for the fantastic review!

We built Advanced IP Blocker specifically to be the “lean and mean” alternative to those bulky security suites, so hearing that you appreciate its efficiency and reliability is the best feedback we could ask for.

Knowing that developers (“Dev Dan”!) trust our architecture validates all the hard work we put into keeping the code optimized.

Thanks for your support!

Hi @thewatchman3,

Thank you for clarifying! That is the missing piece of the puzzle.

Confirmed Issue:
We have identified a bug where our 2FA module intercepts the login process even when a valid Application Password is used. It tries to redirect the API request to a visual 2FA form, which causes MarsEdit to fail with a 500 error.

Immediate Workaround:
Please disable 2FA for your user account temporarily. This will allow MarsEdit to connect immediately.

The Fix:
We have already coded a patch to respect Application Passwords correctly. This will be released in version 8.8.0 (likely within 24-48 hours). Once you update, you can re-enable 2FA, and MarsEdit will continue to work seamlessly.

Thank you for your patience and for helping us find this edge case!

Best regards,

Advanced IP Blocker Team

Advanced method:

1. Go to Security > Blocking Rules > Advanced Rules.
2.  + Add New Rule
3. Rule Name: MarsEdit
4. IF (All conditions must be met): Request URI -> Contains -> xmlrpc.php
5. Click AND to generate a new condition
6. AND User-Agent -> Contains -> MarsEdit
7. Action Allow (Bypass Security)
8. Click Save Rule.

• This reply was modified 7 months, 2 weeks ago by IniLerm.

Hi @thewatchman3,

Please try the method explained in the following answer first.

I understand the frustration. Let’s get MarsEdit working.

The “500 Error” suggests that a security rule (likely the WAF) is intercepting the complex XML data sent by MarsEdit and blocking it, even if the XML-RPC setting itself is open.

The Solution (Global Exclusion):
To guarantee access for your app without lowering your overall security, please add the endpoint to the Global Exclusion list. This bypasses all checks (WAF, etc.) for that specific URL.

1. Go to Security > Settings > General Settings.
2. Find the “Global URL Exclusions” box.
3. Add /xmlrpc.php on a new line.
4. Click Save.

Check your XML-RPC Mode:
Go to Security > Settings > Login & User Protection.
Ensure “XML-RPC Protection Mode” is set to “Smart Protection” (recommended) or “Enabled” (if Smart blocks it). Do NOT set it to “Completely Disabled”.

This combination (Exclusion + Enabled) will allow MarsEdit to connect flawlessly.

One last check:
Please also go to Security > Blocking Rules > Honeypot URLs (& WAF) and ensure that /xmlrpc.php is NOT in that list. Sometimes it is added there by mistake, which would instantly block any app trying to use it.

Best regards,

Advanced Ip Blocker

• This reply was modified 7 months, 2 weeks ago by IniLerm.

Hi @muhammadbey,

Stopping spam registrations is exactly what this plugin is designed for. Here is the recommended “Battle Plan” to stop the assault immediately:

Step 1: The Basics (Stop 80% of bots)

1. Go to Security > Blocking Rules > Honeypot URLs.
2. Ensure the default list is active. Bots often scan for vulnerabilities while registering; this traps them.
3. Go to Security > Settings > Threat Intelligence.
4. Enable “Join Community Defense Network” and “Enable Community Blocking”. This instantly blocks thousands of known bad IPs that are attacking other sites right now.

Step 2: The Heavy Artillery (Stop the rest)

1. Go to Security > Settings > Login & User Protection.
2. Enable reCAPTCHA. Use v3 (Invisible). It works on both login and registration forms to detect bots without annoying humans.
3. Enable “Prevent Login Hinting” and “Disable User Enumeration” to stop them from scanning your existing users.

Step 3: If they come from specific countries
If the spam comes from countries where you don’t do business (e.g., Russia, China):

1. Go to Security > Settings > Core Protections.
2. Enable “Geo-Challenge” (not Geoblock) for those countries. This forces a browser check that most registration bots cannot pass.

Start with Step 1 and 2. That should stop the massive numbers immediately.

In addition, you have many advanced options that you can configure; check the official settings at https://advaipbl.com/

Best regards,

Advanced IP Blocker Team

Hi @wassi007,

Thank you for the update. Since the standard check is still failing in the background process, this points to a specific configuration detail in your WordPress settings.

Could you please check one setting for me?

1. Go to Settings > General in your WordPress dashboard.
2. Look at the “WordPress Address (URL)” and “Site Address (URL)” fields.
3. Do they start with http:// or https://?

Why this matters:
Even if your site loads with a padlock (SSL), sometimes the internal database setting is still set to http://, and an external plugin (like “Really Simple SSL” or a server rule) forces the redirect.

Our background scanner reads this database setting directly. If it sees http:// in the database settings, it will report “Critical” because WordPress technically thinks it is unencrypted, even if the redirect saves it.

The Fix:
If those fields say http://, please change them to https:// and save. This should instantly resolve the false positive in the scan report.

Let me know what you find!

Best regards,

Advanced IP Blocker Team

Hi @ponting ,

Thank you so much for the 5-star review!

We are thrilled to hear that the plugin is helping you save bandwidth. Blocking unwanted traffic efficiently is exactly what we aim for—keeping your blogs fast and your server resources free for real visitors.

Thanks for trusting Advanced IP Blocker!

Best regards,

Advanced IP Blocker Team

Hello @martje65,

Thank you for reporting this!

You are absolutely right. We identified that the import logic was strictly looking for settings in the root of the file and was missing the data nested within our new export format structure. This prevented “Manual Blocks” (which are stored in a custom database table) from being restored correctly.

Good news: We have just patched this issue. The fix is included in version 8.7.4.

Once you update to 8.7.4, your exports will correctly include and restore all your manually blocked IPs alongside your configuration settings.

Thanks again for helping us improve the plugin!

Best regards, The Advanced IP Blocker Team