How can we export the Blocked threats and blocked Ip’s?

Hi @fedsmartsites, thanks for your question.

Currently, you can use Wordfence > Blocking > Export All IPs to export the permanent/current blocked list from Wordfence. If you wish to read IP data from the database or import your own data, we use IPv4-mapped IPv6 format.

If you want to confirm that IPs in your wfblocks7 table look correct, you can run the query: SELECT inet6_ntoa(ip) FROM wp_wfblocks7.That will show IPv6 addresses in their usual format, and IPv4 addresses like ::ffff:127.0.0.1.

Within MySQL, you can get the right format using inet6_aton() like: inet6_aton('::ffff:127.0.0.1'). The ::ffff: is what allows IPv4 addresses to be stored in the same table as IPv6 addresses.

As we can’t support all custom actions and scripts people may wish to perform on WordPress/Wordfence, remember to take a backup of your tables beforehand in case something goes wrong.

The contents of a regular Wordfence export/import (which uses a key instead of a physical file) can be seen here: https://www.wordfence.com/help/tools/import-export/

Thanks,
Peter.

@wfpeter
Thanks for the reply.

However, we are actually looking for the data from the Live traffic Wordfence > Blocking > Live Traffic. Is there any way we can export the Live traffic data? Also, we are looking for the data from the last 90 days.

Thanks.

Hi @fedsmartsites,

Live Traffic logs are kept for 1-30 days depending on your setting in Wordfence > Live Traffic > Maximum days to keep Live Traffic data. This is due to the constantly changing nature of IPs and the IPs threats are coming from, so Wordfence mostly uses its global blocklist of “bad” IPs to protect your site(s) in real-time. If you can see your site is being hit many times in Live Traffic right now, you can take action but that data isn’t necessarily relevant 30+ days later.

We do have a development case open to add an export option to the 1-30 days of data that does appear on this page, and I will submit yours to that. All customer suggestions are listened to and if we see any trends, priorities can be increased, although we can’t provide regular updates about development work here on the forums.

If you can let us know the use-case for any data you’d like from here past the IPs, then we can consider the data our customers consider useful for export.

Thanks again,
Peter.