Blocking IP of user accessing specific URLs

snaphappyme,

In general, the URLs entered for this feature have to exactly match the request, for the IP to be blocked.

For question 1, entering “/filename.php” in the options will not block a request where there is a query string like “?go=blahblah” on the end.

But, if you have certain URLs that include specific query strings that you want to block, entering “/filename.php?go=blahblah” in the Wordfence option will block those requests, but not “/filename.php?go=somewhere_else” or “/filename.php” without a query string.

For question 2, I don’t think I have a server where /filename is automatically treated as /filename.php, but how it will work probably depends on the way the server is set up to handle it, and you would have to test it on your specific setup. (It’s best to ask a friend to visit the URL you are trying to block, so you don’t block yourself, of course!)

Would be great to add a feature where we can use pattern matching or wildcards.

In this way we could trap/catch the hackers using parsed strings. Usage idea:

• /filename.php?* (meaning block use of querystrings on filename.php)
• /filename.php?go=* (meaning block querystring variable “go”)
• /pagename?* (block short form and querystring use on page name)

Would you consider this for a future update please?

Many thanks

Thanks for this plugin. I just want to know how to stop spam and adult referral traffic from Wordfence?

snaphappyme: Thanks for the suggestion, I will pass this one on to the dev team too.

Softfully: Some of the spam may not be possible to block with a plugin, depending on how it is being done. Can you start a new post explaining the types of problems you are having? This helps us keep track of open issues, and it stays in line with the www.remarpro.com rules. Thank you for the feedback, too!

I second snaphappyme’s request for wildcard inclusion.

I have sites getting regularly hit by requests for all sorts of random URLs (looking for vulnerabilities) but frequently ending in the same file or containing a string that could be used to block.

Thanks for your work on the plugin.

Much appreciated.

I’ve been bugging WF developers for a while to allow wildcard strings in the URL blocking. Thanks guys for the votes. Shew, it would be so useful. I’d imagine it would be some sort of regex, hopefully the same as we’d use in .htaccess.

What would be useful in my case is directory strings such as /.*/.*/honeypot.html

result=instablock!

MTN

I’d add, with this feature combined with other honey pots, country blocking, hide login URL, and some other stuff (server firewall etc.), it’s actually possible to run a site with almost no criminal traffic. Wordfence “Real-Time WordPress Security Network” is huge as well, but WF doesn’t use available blacklists apparently that would block a lot more stuff (I know that from stuff that slips through and is easily identified as criminal), so it’s up to us users to re-invent the wheel. Me, I’d pay a bit more if WF would utilize some of the available black lists.

Back to you Snaphappy, can you get into your server configuration? Sometimes you can tweak a few things that’ll make server accept more traffic. Tech support at hosting company?

MTN

I see that version 6.1.5 added support for wildcards in “Immediately block IP’s that access these URLs:”

Nice! thank you WF.

In the revised explanation text has added some info on this:

Separate multiple URL’s with commas. Asterisks are wildcards, but use with care. If you see an attacker repeatedly probing your site for a known vulnerability you can use this to immediately block them. All URL’s must start with a ‘/’ without quotes and must be relative. e.g. /badURLone/, /bannedPage.html, /dont-access/this/URL/, /starts/with-*

I was wondering if the level of support for wildcards is documented somewhere.

For instance, are all or only some of these types of uses supported:

/**/config.php
/*happy/config.php
/*happy*/config.php
/joy/*config.php

Thanks

Woo hoo. We are on the way.

Is there detailed documentation?

I need wildcards for querystring handling in particular, where hackers may vary the order of parameters in the querystring as well as play with mixed values for these same parameters.

@wfmattr has the development team drafted some examples that show the full spectrum of possibilities for the wildcarding function? The average examples don’t suffice.

Can wildcards be used to replace and normalised filepaths too? that way you could do..

/wp-content/plugins/*/*upload.php?*

In this way you could block any attempt to access any plugin that had a php file with ‘upload.php’ in its name….