Blocking list

Hi @amiya1672, thanks for getting in touch. Your site is also relevant to my interests, so thanks for bringing your work to my attention!

Some of the WAF rule blocks, as they aren’t assigned a block expiration time, never appear on the Firewall > Blocking page for you to review and will just be shown in Live Traffic.

If Wordfence > All Options > Brute Force > Amount of time a user is locked out and Wordfence > All Options > Rate Limiting > How long is an IP address blocked when it breaks a rule? are set to low timescales such as minutes or hours, you may never see them on any blocked list either as they’ve already been removed when you check. You can try increasing these to days or months if you prefer but we generally recommend around 30 minutes to prevent issues for legitimate site visitors who’ve found themselves blocked by mistake.

Thanks,

Peter.

Hi @wfpeter , thanks for getting back to me. And glad to know my website interest you!
It still doesn’t explain why the blocklist doesn’t get updated anymore from late December though? I’d at least expect a few IP addresses to be added to the list over the last month or so. This is because, before late December, I usually see the list having a few new addresses added each day. So with no new address being added to the list, it makes me anxious if there is an issue with my Wordfence plugin…

I did check the ow long is an IP address blocked when it breaks a rule?, it is currently set for more than 1 hour.

Kind Regards,
lily

Hi @amiya1672,

Is the block list you refer to the one at Wordfence > Blocking > Blocks for yourdomain.com?

The best way to check if Wordfence has been blocking IPs would be to refer to Wordfence > Live Traffic and filtering by Blocked or Locked Out. You should be able to see the reasons for any blocks being given there and you can adjust your settings accordingly if you’d like to see them blocked for longer. Don’t forget that a lack of blocks doesn’t necessarily mean that Wordfence isn’t working and having “SECURITY ONLY” selected (default on new installations) on this page will log less information than “ALL TRAFFIC”. You could temporarily try switching to “ALL TRAFFIC” if you need to spend a period of time checking that everything is working as expected.

Thanks again,

Peter.

Hi @wfpeter
Ah okay. Thanks for the clarification.

Kind Regards,
Lily

Hi @amiya1672,

Let me know how you get on if you do choose to test blocks by logging all traffic. Typically topics here on the forum will be open without response for around 7 days so I can leave this open for now.

As some blocks will happen as soon as an offending IP hits the site, they won’t have tried a security event like an attempted login so you should see more information this way. Once you’re happy with the situation, you can return Live Traffic to only log “SECURITY ONLY” as this method takes less resources on your site, such as database space.

Thanks,

Peter.