Blocked IP Report not telling the truth

Hi @panotop, thanks for seeking clarification on this data.

The most likely reason for an IP with further hits being reported as “No attempts have been made to access the site…” is that the firewall or another Wordfence setting is catching it before it hits your manual block.

Filtering Live Traffic by that IP would show whether these hits were blocked for another reason.

There is an outside chance that this could mean something is “fixing” the IP address too late after blocking should have taken effect. We’ve seen it with the Cloudflare plugin on occasion, but it could also be done with custom code or another plugin. We would be happy to look at your site diagnostic report to see if that might be the case if you’d like to send one to wftest @ wordfence . com.

Click on “Send Report by Email”. Please add your forum username in each case where indicated and respond here after you have sent them.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Thanks,
Peter.

I sent the diagnostic.

I also filtered on live traffic and did indeed find that each instance had “blocked by Wordfence Security Network”.

Thanks @panotop,

The block by “Wordfence Security Network” does look like the reason the message, “No attempts have been made…” is being given for your own rule. I have made a suggestion to the team that we slightly alter the wording to reflect this as it may cause confusion in other cases too.

Many thanks,
Peter.