Most of blocking that sort of thing has to be done by hand, you would enter that URL under “/options/immediately block IP’s that access these URLs:”
You could shorten it something like this: /*/*/wp-e-*/license.txt
I’ve found it’s best to test this by running under a VPN so you have a different IP, then browse to the blocked IP yourself and see if you get Wordfence blocked.
This reminds me of another feature the Wordfence of the future should have, that of testing these blocks somehow, quickly.
This kind of blocking can be super effective provided you’re getting a lot of scans for one attack vector. But doing it for each and every probe is whack-a-mole. Wordfence in my opinion should be running their own list that intercepts these probes. Perhaps they do, but a lot of them sure get through.
To be fair, Wordfence probably blocks quite a few probes at their basic level, using their “Real-Time WordPress Security Network.” My understanding is that this sort of blocking is not reported to the Wordfence user when it occurs. Happy to be corrected.
MTN
