blocking for accessing wildcards urls not working?

Hi @catsfoto1se, thanks for reaching out.

That wildcard would match anything relative to the domain such as example.com/some-setup-page, so doesn’t include the other subdirectories. I have run a test myself and was able to successfully block the URL you are describing using /backup/wp-admin/*setup* in the
“Immediately block IPs that access these URLs” textbox.

You can read more about this here: https://www.wordfence.com/help/firewall/options/#immediately-block-urls

Thanks,

Peter.

@wfpeter so /*setup* only protects if a directory or file containing “setup” in the root of the server?

anyway to protect “setup” everywhere? (no visitors should ever visit something like that”

Hi @catsfoto1se,

That’s right as the preceding slash signifies it’s a path after the main domain only. *setup* on its own would block anybody visiting a file or directory containing the word setup anywhere to be blocked.

Be careful with this though, as it would block anybody should you ever have a blog post with ‘setup’ in the title, and therefore probably the path (slug) to the post too. It will also block you should you decide to visit one of these files. In fact, some plugins may name their admin pages in a way that may get caught by this block.

My general advice is that Wordfence does all of the important blocking for you automatically so you don’t have to, but when blocking specific URLs I would point as specifically to the paths you’d like to protect as possible to prevent legitimate visitors getting caught by a more generalized one.

Thanks,

Peter.

thx for the information @wfpeter, this server is an private server, and wants to ban everything, so *setup* would be fine..

`