LIVE VIEW questions

Hi @kristinubute, thanks for your message.

As I explained before, IPs frequently will randomly target websites to see if something can be exploited without any prior knowledge of the platform or plugins installed beforehand.

You don’t need to constantly keep an eye on the data as Wordfence is blocking the important traffic so you don’t have to. We generally consider a manual blocking regime time-consuming and unnecessary, but it’s good to check in with Live Traffic to stay generally informed.

Your question about legitimate bots is explained in my post here: https://www.ads-software.com/support/topic/viewing-live-view-and-understanding-the-breakdown/#post-17276745

Live Traffic shows “SECURITY ONLY” as default rather than “ALL TRAFFIC” as the amount of data held is significantly increased, but isn’t necessarily useful. For busy sites, there would be many successful page loads and other normal actions you don’t need to monitor to filter through. There’s no issue with yours by the sounds of things, but if you change it to “ALL TRAFFIC”, past data won’t be reflected, only traffic from that moment onwards. I don’t recommend you change this.

Your scans should keep you on top of any critical or high severity warnings. Avoiding potential reinfection of the site may also be down to admin ccount security and keeping plugins and WordPress itself up-to-date.

I urge you to thoroughly read our documentation and free learning center to become well-versed with the plugin and interpreting the data and settings you are curious about:

https://www.wordfence.com/help/
https://www.wordfence.com/learn/

Thanks,
Peter.

• This reply was modified 11 months, 3 weeks ago by wfpeter. Reason: Removed copied text from customer to address questions

Thank you I will read with those links you provided.

Thanks

Thanks! Best of luck with your use of Wordfence going forward, glad to have you on-board.

Peter.

THanks Peter. If I could just ask a few more questions. I am reading your links also. I appreciate that.

I won’t be reading all the Live View like you suggested. But still few questions firstly.

I see in Live View you can actually see when someone has been to Cart or Checkout page (but obviously cannot see who unless they login).

If someone Used an invalid username ‘admin oR other name that doesn’t exist’ to try to sign in would they be auto blocked permanently OR only a certain time period?

What does this type of IP range mean? 2607:f298:6:a077::481:f71c

2405:4800:5f23:6700:ffff:ffff:ffff:fffc

That doesn’t look like a normal IP (its in our blocked IP area). Not sure whether I did it weeks ago or auto blocked by your software. Is there a way of telling what this IP range means or who it is? It doesn’t look like a normal IP address range.

We are based in AUstralia. And if an IP range is blocked – Clifton, New Jersey, United States was blocked for UA/Hostname/Referrer/IP Range not allowed – and they are trying to access the login page, and as it says its Clifton New Jersey and NOT Australia, therefore I would assume dodgy and to keep them blocked? I assume the system blocked it ?

And it says beside that 15 block counts. So someone with that IP has tried 15 times to login? Is that what that would mean please?

Apologies for my questions in advance.

Thanks

Also in the scan, it says there is a particular user with a very easy password. Can I send a reset email or something to that User for them to make it a more secure and harder password?

As in Send a LINK to reset their password ? Or what is the best way to do this please?

We are NOT using FA2 yet.