IniLerm

Hello @sabotoro,

That is a brilliant observation, and the details you just provided gave us the exact missing piece of the puzzle! I can explain exactly what is happening: it is a False Positive triggered by internal server processes.

Here is the technical breakdown:

1. The “Empty UA” Rule: By enabling the advanced rule to “Block Empty UA”, you are not only catching bad bots, but also catching internal server processes (like server-side cron jobs triggering wp-cron.php, loopback requests, or internal health checks) that often execute without a User-Agent header.
2. Why Cluj, Romania? Because these requests originate from your own server internally, their IP is usually 127.0.0.1 (localhost) or empty. Since you are likely using the free ip-api.com Geolocation provider, when the plugin asks the API “Where is this empty/local IP from?”, the API simply responds with the physical location of the machine making the request: your own server in Cluj.
3. Why no 403 in the server logs? Because these are internal loopback requests generated by the server itself, they rarely show up in the public access.log the same way external traffic does.

How to fix this False Positive: You have two options to stop logging your own server as an attacker from Romania:

Option A (Recommended): Switch to MaxMind Local Database Go to Security > Settings > Geolocation and switch your provider to the Local Database (MaxMind). Since this database runs locally on your server, it perfectly understands that 127.0.0.1 is a local IP and will correctly display it as “Unknown/Local” instead of querying an external API that geolocates your server’s datacenter.

Option B: Exclude your Server from the Advanced Rule If you want to keep the “Empty UA” rule, you need to tell it to ignore internal requests. Edit your Advanced Rule and add a second condition:

• Condition 1: User Agent Matches Regex ^$
• Condition 2: IP Is Not 127.0.0.1 (Match ALL conditions).

This will stop your server from self-blocking its own internal maintenance tasks.

What a fantastic edge-case to debug! We hope this completely clears up the mystery of the Romanian bots!

Hello @sabotoro,

Thank you for your patience and for the additional details.

1. About the Bot & Scraper Rules
   Yes, we are absolutely sure. The 3 rules listed in our cookbook specifically target known malicious scraper signatures (like libwww-perl, empty referers combined with weird HTTP protocols, etc.). Legitimate browsers (Chrome, Safari) or good bots (like Googlebot) do not use these signatures. Your human traffic is perfectly safe.
2. Highlighting Issue (CSS Conflict)
   By default, our dropdown does highlight selected countries with a grey background to help you keep track. If you are not seeing this visual cue, you are experiencing a CSS conflict in your WordPress Admin. Another active plugin in your backend is likely loading a global stylesheet or an older version of the Select2 library that overrides our standard styles, making the dropdown difficult to use on your specific setup.
3. The “Whitelist EU” Strategy & Its Hidden Dangers
   We understand why you’d prefer to just select “EU” and block the rest of the world. However, in modern web architecture, a global “Default Deny” geoblock is extremely dangerous.

If you block the entire non-EU world (which includes the United States (US) and Great Britain (GB)), you will instantly break your website’s background services. Payment gateways (Stripe, PayPal), CRM webhooks (Mailchimp), and social network APIs send their background requests from servers located in the US. If you geoblock the US, those vital connections will return a 403 error, and your store/formulary will stop working.

This is exactly why we encourage compiling a smaller blocklist of specific, high-risk countries rather than blocking the entire globe.

However, if you are 100% sure your site does not rely on any external US/Global APIs, you can use our new Copy/Paste tool. Instead of scrolling, you can copy this raw comma-separated list of non-EU codes (we have safely removed US and GB from this list just in case!):

AF,AL,DZ,AS,AD,AO,AI,AQ,AG,AR,AM,AW,AU,AZ,BS,BH,BD,BB,BY,BZ,BJ,BM,BT,BO,BQ,BA,BW,BV,BR,IO,BN,BF,BI,CV,KH,CM,CA,KY,CF,TD,CL,CN,CX,CC,CO,KM,CD,CG,CK,CR,CI,CU,CW,DJ,DM,DO,EC,EG,SV,GQ,ER,SZ,ET,FK,FO,FJ,GF,PF,TF,GA,GM,GE,GH,GI,GL,GD,GP,GU,GT,GG,GN,GW,GY,HT,HM,VA,HN,HK,IS,IN,ID,IR,IQ,IM,IL,JM,JP,JE,JO,KZ,KE,KI,KP,KR,KW,KG,LA,LB,LS,LR,LY,LI,MO,MK,MG,MW,MY,MV,ML,MH,MQ,MR,MU,YT,MX,FM,MD,MC,MN,ME,MS,MA,MZ,MM,NA,NR,NP,NC,NZ,NI,NE,NG,NU,NF,MP,NO,OM,PK,PW,PS,PA,PG,PY,PE,PH,PN,PR,QA,RE,RU,RW,BL,SH,KN,LC,MF,PM,VC,WS,SM,ST,SA,SN,RS,SC,SL,SG,SX,SB,SO,ZA,GS,SS,LK,SD,SR,SJ,SY,TW,TJ,TZ,TH,TL,TG,TK,TO,TT,TN,TR,TM,TC,TV,UG,UA,AE,UM,UY,UZ,VU,VE,VN,VG,VI,WF,EH,YE,ZM,ZW

IMPORTANT: Remember, this is just an extreme example that you should adapt to your site.

Just go to Geoblocking, click the “Paste raw 2-letter codes” link below the dropdown, paste that chunk, and hit “Add Countries”. It takes 1 second!

We hope this clarifies why the interface is built the way it is, and we strongly suggest looking into your raw server logs (access.log) to uncover the true IPs hiding behind those empty User-Agent requests.

Best regards.

Final update on the missing IP issue:

If the “Top Attacking IP” is completely empty or simply not showing up in the Dashboard logs alongside those 403 errors, it’s very likely related to two things: running an outdated version of the plugin, or missing a core configuration for the Geolocation engine.

To ensure the plugin can successfully extract, log, and map the attacker’s IP to a specific country (like Romania), please double-check your Geolocation settings:

1. Go to Security > Settings > Geolocation.
2. Make sure you have an active Geolocation Provider selected.
   • For most users: We recommend selecting the default ipapi.com (Free) option. It requires zero configuration and works out of the box.
   • For advanced/high-traffic users: We highly recommend switching to the Local Database (MaxMind) option. It downloads the database directly to your server, providing lightning-fast, zero-latency IP lookups.

Once your plugin is updated to v8.9.4 and your Geolocation provider is confirmed, the system will have all the necessary tools to accurately log the IPs behind those malformed User-Agent attacks.

Feel free to reach out if you need help configuring any of these options!

Hello @sabotoro,

Thank you for reaching out, for your kind words, and for reading our previous support threads! We are always happy to help.

To ensure you have access to the latest interface improvements and security definitions, we highly recommend updating the plugin to the latest version (v8.9.4). Also, for maximum performance and compatibility, please ensure your server is running PHP 8.1 or higher.

Regarding your two questions:1. No IP logged & 403 Errors every 15 minutes

Looking at the scenario you described (403 errors, empty User-Agents), this is a classic signature of an automated malicious bot or security scanner trying to probe your site.

If the IP is completely blank in the logs, it usually means the request is bypassing standard headers or there is a reverse proxy (like Cloudflare, Sucuri, etc.) involved. If you use a CDN, please go to Security > Settings > IP Detection and ensure your proxy IPs/ASNs are added to the “Trusted Proxies” list so the plugin can extract the real visitor IP.

To proactively stop this specific attack, you can use our Advanced Rules Engine to block any request that has an empty or malformed User Agent.

Go to Security > Advanced Rules and create this rule:

• Name: Block Empty UA
• Condition: User Agent Matches Regex ^$
• Action: Block (1440 minutes)

This will instantly drop the connection for these annoying bots.2. Blocked Countries Selector Difficulty

We completely agree with you! Manually selecting dozens of countries from a standard dropdown is very tedious.

The great news is that we solved this exact problem in our recent updates (v8.9.2+). If you update the plugin, you will find two massive improvements to the Geoblocking interface:

1. The dropdown is now powered by an advanced interface that makes searching and keeping track of selected items much easier.
2. Brand New Country Copy/Paste Feature: You no longer need to use the dropdown at all! You can simply find a raw text list of 2-letter country codes (e.g., RU, CN, RO, BR), copy them, and paste them directly into the Geoblocking selection box. The system will instantly read them and add all 50+ countries for you in one second.

Please update to v8.9.4, try out the new country paste feature, and let us know if that improves your workflow!

Best regards.

New Update Available:

= 8.9.3 =

• NEW FEATURE: DeepScan for Agencies. Granular control over email notifications. Choose when alerts are sent (e.g., only for critical vulnerabilities) to prevent notification fatigue.
• ENHANCEMENT: Added a dedicated toggle to independently enable or disable the vulnerability (CVE) check.

Hi @wassi007,

Thank you for reaching out again and for your excellent suggestion.

Actually, your use case makes perfect sense. We understand that many advanced users and agencies rely on centralized management tools like InfiniteWP or MainWP to handle routine plugin updates across multiple sites. For users in your scenario, receiving standard “update available” emails from our plugin is redundant, but receiving critical “vulnerability detected” alerts is still essential.

Currently, our DeepScan email report is designed as a unified “Site Health” summary. However, adding granular control over what triggers an email notification (e.g., a toggle for “Alert on Vulnerabilities only, ignore standard updates”) is a fantastic idea to make the plugin more agency-friendly.

We have added this specific granularity request to our development roadmap. While it won’t be in the immediate patch we are rolling out today, we will aim to implement these separate toggles in a future release so you can perfectly tailor the alerts to your InfiniteWP workflow.

In the meantime, if the update emails are too overwhelming, your best option is to temporarily disable the automatic scans and rely on running a manual DeepScan periodically, though we understand this isn’t the ideal “hands-off” solution you are looking for.

Thank you again for helping us improve the plugin for power users!

Best regards, Advanced IP Blocker Team

Hi @theboina,

Great news! Following up on our previous conversation, you can officially forget about the risky JSON workaround.

Thanks to your excellent feedback, we have just implemented a safe, built-in “Copy/Paste Raw Codes” feature. We will be releasing version 8.9.2 in the next few hours, which includes this highly requested improvement.

Here is how the new feature works:

1. Under any country selector (Geoblocking, Geo-Challenge, or Whitelist Login), you will now see a new “Copy/Paste Raw Codes” button.
2. Clicking it opens a text area containing your currently selected countries as 2-letter codes (e.g., US, CA, MX).
3. You can easily copy this list and paste it into other sites you manage.
4. The system is smart enough to extract only the valid 2-letter codes from whatever you paste and safely ignore any other text or invalid formatting, preventing any risk of corruption to your settings.

A quick but very important recommendation when configuring your countries:

• Geoblocking vs. Geo-Challenge: Please make sure you do not add the same countries to both the Geoblocking list and the Geo-Challenge list simultaneously. If a country is already blocked via Geoblocking, sending them a Geo-Challenge has no effect (they are simply blocked). Choose one method per country.
• Whitelist Login Countries: Ensure that the countries you place in the “Whitelist Login Countries” list are never included in your Geoblocking or Geo-Challenge lists. Otherwise, you risk contradicting the rules and accidentally blocking legitimate login attempts.

Thank you once again for helping us improve Advanced IP Blocker. Keep an eye out for the 8.9.2 update in your dashboard shortly!

Best regards,

Advanced IP Blocker Team

Hi @theboina,

Thank you for the excellent feedback! You are completely right; the visual dropdown (Select2) is great for selecting a few countries on a single site, but it becomes a bottleneck when you manage a fleet of websites and want to replicate a 50-country blocklist quickly.

I have added a feature request to our roadmap to implement a “Raw Text” mode or a “Paste to Select” function for the country fields in an upcoming update to solve exactly this.

In the meantime, here is a Pro-Tip workaround (For Advanced Users):

Since the full Import/Export feature overwrites all settings, you can do a surgical “copy-paste” using the JSON files if you are comfortable with text editors:

1. On the source site, go to Security > Settings > Import / Export and click “Export Template (No API Keys)”.
2. Open the downloaded .json file in a code editor (like VS Code or Notepad++).
3. Search for the line “geoblock_countries”: [.
4. Copy that entire array block (down to the closing ],). Example:codeJSON
5. "geoblock_countries": [ "AF", "BD", "CN" ],
6. On your destination site, do an Export of the current settings.
7. Open that file, find the empty “geoblock_countries”: [], array, and replace it with the block you copied.
8. Save the file and Import it back into the destination site.

⚠️ CRITICAL WARNING: JSON formatting is extremely strict. If you miss a comma or a bracket when pasting, the import will fail or corrupt your settings. Please always keep an unmodified backup of your JSON before experimenting!

Thanks again for helping us identify these workflow bottlenecks.

Best regards,

Advanced IP Blocker Team