Multiple 503 But Not Added to Block List

Hi @neil677, thanks for your question.

Automatic or manual blocks via Live Traffic will block an IP for the duration you have specified under Wordfence > All Options > Rate Limiting Rules > How long is an IP address blocked when it breaks a rule, which could be as low as 5 minutes. You can increase this value to hours or even days to try stemming the flow of retries if you’re noticing a lot of activity from certain IPs.

During the timescale specified in the above setting, they’ll appear on the list in the Wordfence > Blocking page. It is possible to click the “Make Permanent” button here after checking the box next to one or more IPs. However, it’s important to note that Wordfence does all of the important blocking automatically so you don’t have to. It may be tempting to permanently block these when you see them but it’s generally an ineffective strategy, taking up your time. Wordfence considers intent of an IP’s request to your site when blocking, so increasing the time they’re blocked before they can retry might be the best deterrent.

Thanks,
Peter.

OK i think I may have an issue
1. IPs are allowed several every minute (my Rate limiting is 5 minutes)
2. I also added this IP manually ti the block list an hour ago and it has since removed it self – so I may have an issue here

I may be having similar issues. I created a separate topic, but reading this, we may be experiencing the same bug, so I’ll summarize what I said here as well.

I recently got an email from a client asking for help, they were locked out of their own site. I logged in and checked the WordFence logs, and verified the client had exceeded the maximum number of failed login attempts. These types of bans are set to last 24 hours and the ban occurred about 90 minutes before I saw the email and investigated.

I don’t know if the ban is still in effect or not, but it’s not showing up in the list of banned IPs, and I can’t manually lift or verify the ban still exists. Either the list is failing to report blocked IPs or they’re being quickly scrubbed from the list.