Blocked IP Address

  • Resolved America Jr

    (@cmccrone)


    8 months, 2 weeks ago

    I blocked an IP address and they are still showing up in the log list trying to visit numerous pages. Is that normal? Or should they no longer be showing in the Live Traffic Log?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfmargaret

    (@wfmargaret)

    Hi @cmccrone,

    Wordfence, as a web application firewall, can’t prevent blocked visitors from loading the server altogether, but it can ensure they see a blocked message instead of visiting the site. It is normal to see blocked IP addresses still appear in the Live Traffic Log.

    In the Live Traffic Log, blocked visitors will have a red circle under Type in their entry, and the Response will generally be a 503. This means that Wordfence served the visitor a Wordfence block page rather than allowing them to load the requested page.

    Please let us know if you have any other questions!

    Thanks,
    Margaret

    Thread Starter America Jr

    (@cmccrone)

    Thank you. Last thing here. How do these IP addresses get added to the whitelist? of of these IPs is an attacker for sure identified by my host.

    I can remove or disable but more keep getting added.

    https://snipboard.io/psUx8K.jpg

    Plugin Support wfmargaret

    (@wfmargaret)

    Hi @cmccrone,

    The allowlisted URLs were allowlisted due to the firewall being in Learning Mode. Learning Mode should only be left enabled temporarily to allowlist false positives. You can read more about Learning Mode here:
    https://www.wordfence.com/help/firewall/learning-mode/

    Please check to ensure your firewall is set to Enabled and Protecting in Wordfence > Firewall > Manage WAF > Web Application Firewall Status. I also recommend disabling or deleting any rules under Allowlisted URLs that were not allowlisted by your own IP.

    Thanks,
    Margaret

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Blocked IP Address’ is closed to new replies.