Cannot Manually Enter IP to “Blocking”

Hi @evelynmsdesigngraphicscom,

Could you please check the “blocked” reason specified in the Live Traffic stream for the offending IPs?

In order to find them use the “Advanced Filters” feature (Show Advanced Filters) and add a filter based on the IP addresses in question (“IP = X.X.X.X”).

Could you also please confirm the value specified for the “How long is an IP address blocked when it breaks a rule” parameter?

—

Regarding the fact that you were unable to permanently add and block more than 5 IP addresses, I was unable to reproduce this behaviour.

Can you see any errors in the browser console when you unsuccessfully try to add another IP?

Could you please temporarily switch to a default theme –if you’re not already using one– and disable all other plugins then reactivate them one by one to see if the issue is related to a conflict?

To do so I recommend the “Health Check” plugin which allows you to disable all plugins and switch to a default theme, but only for your user.

Hi+

Thank you for the response and suggestions…

I do not “see” the “Advanced Filters” or “Show Advanced Filters” options — where exactly should I be looking for those?

Here is the additional information you requested:

I have Brute Force Protection enabled and set for 3 login failures and 5 forgot password attempts in a 30 minute time frame and locking the user out for 1 day.

I have Rate Limiting enabled with 60/minute for anyone then block it; 240/minute for crawler page views then throttle it; 240/minute crawler’s 404s then block it; human page views at 60/minute then throttle; human 404s 60/minute then block it; 404s for known vulnerable URLs at 60/minute then block it. IPs are blocked automatically for 5 days when they break a rule.

No errors show up when I attempt to “create a blocking rule” by copy/paste the IP address in and typing in the reason – the “block this IP address” button simply won’t work (it does look ‘active’ after I enter the appropriate data though) and it WAS working for a while… It is at version 7.1.2….

I have not added any new plugins between the time that this WordFence Feature was working and the time it was not working.

Thank you for suggesting the Health Check Plugin, I will work on that suggestion and let you know – but I wanted to get the rest of this information to you and find out where I’m supposed to be looking for those “show advanced filters” so I can check the “blocked” reason on the live traffic stream…?

Thanks!

Hello+

I have installed and activated the Health Check Plugin – LOVE that! Thank you so much for the suggestion!!

I have enabled their Troubleshooting Mode which put the site into the default Twenty Seventeen Theme and deactivated all plugins. Then I activated the WordFence Plugin and attempted to manually enter one of the IP Addresses that I want to Block (via copy/paste) and typed in my Reason – the “block this IP address” button still will not work… Please advise.

(I’m still waiting to find out where to look for that “show advanced filters” option so I can provide you with that information, too.)

Thanks!

Hi @evelynmsdesigngraphicscom,

The “Advanced Filters” feature (Show Advanced Filters) is located on the Live Traffic page (just above the actual Live Traffic list of entries).

Can you confirm that you’ve checked the browser console for errors?

Have you tried clearing the cache? Or accessing the site from another browser?

Can you see any errors in the PHP logs?

Hello+

Thank you for the instructions, I found the Advanced Filters! My list of offending IP’s (that I have received WF emailed alerts about and that I cannot manually enter) is up to 25…I do find one of those offenders on the Live Traffic Advanced Filters list.

That particular offending IP has a block reason of “blocked for Exceeded the maximum global requests per minute for crawlers or humans” (which I have that set for crawlers at 240/minute – then block – and for humans at 60/minute – then throttle).

The other IPs on my list are older than 04/16/18 – it is difficult to locate a particular IP on that list, is there a “search for IP” option somewhere on it? (Where I can enter the offending IP that I am looking for?) If so, please advise and I will provide you with additional block reasons.

I have checked the browser console and do not see any errors listed.

I have repeatedly cleared my cache via the back-end of WP and the browser cache and then refreshed the browser (FireFox, Chrome, and Edge) – it does not solve this issue.

I have tried manually entering the offending IP & reason via FireFox, Chrome, and Edge – none have been successful.

Please tell me where to look for “errors in the PHP logs” and I will let you know what I find….

Hello+

After upgrading WF to the most recent version (it previously was at the most recent version prior to the update you just put out), I was able to manually enter all but 2 of the offending IP’s… I did a filter search and neither of them are on the Block List. When I enter either of those 2 IP’s the “Block This IP Address” button flashes to the active color for an instant and then goes back to the inactive color. Please advise.

Hi @evelynmsdesigngraphicscom,

Could you please share the two IP addresses you’re not able to add to the blocking list?

Also please check again the browser console; both the console and network tabs to see if there any errors.

Regarding the PHP logs please see the “Log Files” section on the “Wordfence –> Tools –> Diagnostics” page or reach out to your hosting provider so they can help you locate the log PHP “error_log” file.

Alternatively you could enable WP_DEBUG and check if any log files is generated.

Hello+

The IP’s are:
#A) 131.244.14 blocked due to invalid username
#B) 101.223.237 blocked due to invalid username

When I am on the WordFence Blocking Page (with the IP address & reason entered), the Browser Console does not show any errors for either IP; The Browser Network does not show any errors for either IP.

Under WordFence > tools > diagnostics > Log Files says, “no log files found”… And, I just discovered that GoDaddy requires me to manually begin recording the “Error Logs” and will only do this for 7 days for this hosting plan – so “no error logs available”. I have begun that and we shall see if the PHP Error Logs are in that “error logs” information…. I again attempted to manually enter these 2 IP’s after enabling GD’s “error logs” – then I navigated to to those files but no error logs were showing yet. I will try again in a few days to see if that is providing anything since I just activated that.

Interestingly enough while researching things I decided to find the Location for each IP and these 2 IP’s seem to not be “complete IP address”… I went back to the emails from you guys and verified that I had copied the complete IP addresses you provided – I did. However several different IP Location Finder websites indicate neither IP is complete or “valid” IP’s… This may be why I am not able to manually enter them to block…

Which leads me to my newest question on this – Why are you sending me incomplete IP’s in these Alert Emails? (I can forward those emails to you, if you give me an address to send them to, so you can see what I originally got.)

Please advise….

Thanks! +ES