Access to this site has been temporarily limited

Hello @misstt and thanks for reaching out and opening a new thread!

I want to verify that your site is detecting IPs properly.

Can you send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

Thanks again!

Thanks @wfadam – I have just done that for one of the sites and will do the other one when I can later today.

Many thanks in advance!

Sent a report from the other site too.
Many thanks.

Thanks for sending those.

I wonder if your host is using some sort of proxy to filter traffic. Both diagnostics you sent me are reporting the same IP address, which is strange. So what is happening is your site is seeing all traffic as the same IP, which is why you are seeing so many blocked users.

If you could reach out to your host and ask them:
“I use Wordfence and they had requested I reach out to you asking about any trusted proxies that I should be adding to my IP detection. All IPs that are hitting my site, are being detected as the same IP.”

Let me know how they reply!

Thanks again!

Many thanks for your help.

My host has said there is no proxy. And has asked what is the IP address, so he can block it from the system – is that going to solve the problem? What else could be causing this to happen other than a proxy?

Thanks again!

If you navigate to your Wordfence > Tools > Live Traffic and find some of these 503 blocks that the users on your site are seeing, can you screenshot them and post them here for me to review? Make sure to block out any sensitive content!

Thanks again!

I’ve looked and there are no 503 blocks for the dates that it happened.

Many thanks,
Tracy.

That leads me to believe that it’s not Wordfence causing this issue. What does the 503 block page look like that your users reported? Is it a Wordfence branded 503 page or just a basic 503?

Try disabling All In One WP Security which I see you have installed. It might be causing the blocks.

Let me know what you find!

Thanks again!

It’s a WordFence page that is displayed in both cases – please see the screen shot of the page here:

https://pasteboard.co/JVafAW1.png

Even with Wordfence disabled? Is this a possible cache issue then?

If you’re seeing a Wordfence 503, you should be seeing this hit in the Live Traffic as well. Still not seeing it?

Thanks!

No not when WordFence is disabled, they can log in fine when WordFence is disabled, this is the screen they saw when it was enabled on 24th March. I have asked them to try again today, WordFence is enabled again, but not heard back yet. Hopefully the issue may have rectified itself – fingers crossed.

Can you clarify again where I check for the 503 block records in case I’m looking in the wrong place? Tools / Live traffic ?? Just checked again – maybe the records aren’t held long enough – looks like they only go back to 27th March?

I have the site included with a facility that reports when a site down – there are quite a few 200 records for an uptimerobot – could that have an affect on this?

Many thanks again!

Hi there, this issue wasn’t resolved. I know the staic IP which the client is trying to log in from but it’s not showing as blocked with a 503. It’s still being blocked as before but there is no 503 block record in the Live Traffic for the time they were blocked from accessing the login screen.

How long do these type of blocks last for – is there a setting that controls the time?

Many thanks in advance,
Tracy.

Sorry @misstt but I never got a notification from your reply.

A 503 will be blocked based on how and why they were blocked.

If they were blocked for incorrect logins or brute force, you can check your Wordfence > All Options > Brute Force Protection options for Amount of time a user is locked out. This will show how long they will be locked out for after breaking any brute force rules.

If they were blocked for any other reason, these block times are listed in Wordfence > All Options > Rate Limiting > How long is an IP address blocked when it breaks a rule.

You seem to be in the correct location for your Live Traffic options (Wordfence > Tools > Live Traffic). The traffic is stored for as long as you set it to store for in that area. You should see two options that affect how far back the Live Traffic will save.
Amount of Live Traffic data to store (number of rows): If your site sees a lot of traffic, you will want to raise this up.
Maximum days to keep Live Traffic data (minimum: 1).

Is the user still seeing blocks? What is the block reason you’re seeing in the Live Traffic? Also if the user could provide you a screenshot of the block page, that would help as well.

Thanks again!

Hi @wfadam thanks for getting back to me.
As mentioned I can’t actually see any recent block records for the static IP address in question that’s why I was wondering if it’s something / a block from awhile ago.

As before they don’t even get to the login screen – it’s a rate limiting type block and the screen shown is the same as I sent you previously – it’s a WordFence screen…

https://pasteboard.co/JVafAW1.png

Here is another one from last week – there are no corresponding 503 records that I can see though.
https://pasteboard.co/JY27Rpv.png

I have just noticed you previously said to switch off All in One Security plugin – I will do that and ask them to try again.

I stress again I can see not block record in the live traffic for the IP for the time they tried to access the login screen last week.

Many thanks in advance.

I wonder if something is cached on their side. If you’re not seeing the traffic in the Live Traffic, then it makes me think they aren’t actually hitting the site.

You could add this IP to the allowlist, if you wanted, just to test to see if this is an issue on their end.
Wordfence > All Options > Advanced Firewall Options > Allowlisted IP addresses that bypass all rules
https://www.wordfence.com/help/firewall/options/#whitelisted-ips

This is the only user having issues, correct?

Let me know what you find!

Thanks again!