In Live Traffic All users seem to be getting 503 Responce

They all seem to be getting this responce.

France was blocked by the Wordfence Security Network at https://www.md0mdi.im/wp-login.php
04/10/2022 16:28:43 (19 minutes ago)  
IP: 51.91.220.143 Hostname: ns31147370.ip-51-91-220.eu
Human/Bot: Human
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36

Hi @axnfell,

“France was blocked…” seems to suggest that you have the Country Blocking enabled which is a Premium plugin feature.

If you are indeed a Premium Wordfence Customer, I recommend opening a support ticket at https://support.wordfence.com as we cannot discuss anything but the free version here on the forums.

You can also access premium support via the Help menu item in the plugin, Help link on the plugin’s Dashboard page, on our documentation homepage or via the HELP link in the footer of all wordfence.com pages.

Let me know if my assumption is wrong and I’ll be happy to assist further of course.

All the best,

Peter.

I have never upgraded to the Premium package, got too many other monthly and yearly registrations that make it impossible for me to even think about going premium.
If France is blocked them looking at the list so is most of the world, I have listings stating 503 for loads of countries.

Has anyone got any ideas about this issue I am seeing, I am getting the same error for practically every country in the world.

James

So Much for Support!!!

Hi @axnfell, sorry for the delay.

If you expand these blocked entries on Live Traffic by clicking them (or the eye icon in the top-right), you will be able to see the reason why Wordfence made the block.

France left https://***.***/ and was blocked by firewall for Known malicious User-Agents at https://***.***/

If you have reasons like Brute Force or Rate Limiting, this could be because your settings for these sections in Wordfence > All Options are too strict – especially if you’ve had complaints from visitors to your site that they’re locked out.

However, if you’re finding a lot of Malicious User Agents, or other rules that Wordfence controls being hit, these are likely to be legitimate blocks to protet your site and not visitors intending to use your site. You can include screenshots of some of these if you wish using a service like Snipboard.

Thanks,

Peter.

Hi,
Here are some of the settings:

https://snipboard.io/iUE1Y7.jpg
https://snipboard.io/4tuwhg.jpg

And the screen shot showing some of the issues:

https://snipboard.io/bSrlij.jpg
https://snipboard.io/CWHF3e.jpg

Hope these links work, not used this before.

James

Hi @axnfell,

“Immediately block the IP of users who try to sign in as these usernames” results in the “Blocked by login security setting” message you’re seeing, so those 503s are caused by trying to log in as those. The others getting caught by “Page not found errors limit for humans”, which is set to very strict in your settings. I don’t recommend this as background files like CSS, Javascript, etc. could sometimes be returning a 404 causing multiples per page and blocking legitimate users. These may not be legitimate users, but I still think they might be too strict.

I generally set my Rate Limiting Rules to these values to start with:
Rate Limiting Screenshot

• If anyone’s requests exceed – 240 per minute
• If a crawler’s page views exceed – 120 per minute
• If a crawler’s pages not found (404s) exceed – 60 per minute
• If a human’s page views exceed – 120 per minute
• If a human’s pages not found (404s) exceed – 60 per minute
• How long is an IP address blocked when it breaks a rule – 30 minutes

Thanks,

Peter.