Firewall not blocking any requests for bad urls

Hi @boionfire81,

Wordfence runs after PHP runs, and before WordPress site content is served to the browser (when optimized), so only the URL that WordPress runs on will be recognized by the plugin. Inputting *mail.mydomain.com* will work for something like “mydomain.com/?s=mail.mydomain.com&othersetting=true” as the wildcards mean it can appear anywhere after your domain.

You’d likely need a block at server level for any subdomains that either don’t run WordPress and Wordfence, or don’t resolve to anything in a browser.

I have also checked on my own site that “Immediately block IPs that access these URLs” will allow *mail.mydomain.com* and still block anybody trying to access /.git, /old, /wordpress, /wp when they are comma-separated or on separate lines as required. The text below that field specifies that they must be paths relative to your domain and start with a “/” without quotes.

Thanks,
Peter.

• This reply was modified 4 months, 1 week ago by wfpeter. Reason: Corrected to "Immediately block IPs that access these URLs"

Ok. I can firewall that at Cloudflare. But there’s still the mydomain.com/wp, mydomain.com/bk, mydomain.com/bc, mydomain.com/backup, mydomain.com/wordpress, mydomain.com/.git urls not in a subdomain that aren’t being blocked either. None of it is being blocked. This same urls they keep coming back either everyday or every other day. Depending on when the guy wants to run his bot.

Hi @boionfire81, sorry to see those paths aren’t being blocked.

How are those URLs formatted in the “Immediately block IPs that access these URLs” field? Note that a syntax error like no commas in between paths/files, or no carriage returns if each one is specified on a new line, and the lack of “/” could be ignoring the paths you intend to block IPs for.

If that doesn’t seem to be the problem, you could send us a diagnostic report so I can try those paths myself. This method just ensures you don’t need to share your domain publicly here. You can do this from Wordfence > Tools > Diagnostics to us at wftest @ wordfence . com. Click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

NOTE: It should look as follows – Screenshot of Tools > Diagnostic > Send by Email

Many thanks,
Peter.