My own IP blocked

I am having the same issue. I just had 7182 attempts to login using my own IP – but it wasn’t me. WF blocked the attempts after 3 attempts. But that blocked me out because WF identifies the attempts with my IP. Don’t understand! Any help much appreciated.

Hi @magicpowers
Where exactly you saw these blocks? do you get some entries showing your own IP address in (Wordfence > Live Traffic > Blocked/Blocked by Firewall)?

Also, please double check that Wordfence can detect your IP correctly by going to (Wordfence > Tools > Diagnostics > IPs) and make sure your IP is appearing there correctly and let me know the header in use.

@richj615 please open a new support thread for your question as per forums rules.

Thanks.

Hi @wfalla

My IP shows correctly in diagnostics.
I saw those IPs as blocked in WF> Dashboard > top IPs blocked. there are still there – 21 block count in the past 30 days – but I did not have any access issues.

now – while I was in my WF I saw a much more serious issue – hope I can post it here as it’s kind of urgent – if needed we can move it to a new post.

Several days ago I BLOCKED a particular IP in my WF.
My understanding of blocking is that this IP will not be able to access, or even see my website.

and yet – in Live Traffic (which I now check regularly – it’s an excellent feature! ) I just saw THAT blocked IP – which is marked as BLOCKED – having visited my website’s specific page today 5 times. The report even says that this person LEFT one page and visited another! How can this be possible??

As this is REALLY important, could you please explain as I need to have a full confidence in your IP blocking feature – which means that those IPs which I manually and permaently blocked should NOT be able to even see my website, let alone browse it.

I look forward to your reply – I took a screenshot of those recorded visits which I can provide to you (perhaps via direct email) if needed.

thanks.

PS when I went to my cpanel and checked all the IP addressses blocked by WF (including my manual blocks) , that particular IP address was NOT there – while showing as BLOCKED in my WF dashboard. So I added it manually in my cpanel.

that’s really of concern – could you please address this

thanks

Hi @wfalla

could you please reply to my posts above – the issue is growing – there is yet another IP address I have blocked in my WF Bloking dashboard which has NOT propagated to my cpanel.

I must know how reliable is the WF IP blocking.

thanks

Hi,
Let me clarify some facts here first then let me know if you still have any question:
– IPs that got blocked in Wordfence aren’t supposed to propagate to cPanel, both aren’t integrated in any way.
– If you blocked an IP by clicking on “Block this IP” in Live Traffic feed, this will block the IP temporarily according to the time set in “How long is an IP address blocked when it breaks a rule“.
– If you want to block an IP permanently, you need to go to (Wordfence > Blocking) and click on “make permanent” link on a previously blocked IP (in the time period mentioned in the previous point) or manually enter the IP there to get it blocked.
– Do you have a screenshot for this IP reported as blocked and still appearing in Live Traffic feed?

Thanks.

HI

Actually, I can see them in my cpanel Blocked IPs Manager as they are recorded on my .htaccess file, blocking access to my website to those IPS at the server level. (I have a VERY good website host). I also spoke with my host who confirmed that this is the case.

You said – “ If you blocked an IP by clicking on “Block this IP” in Live Traffic feed, this will block the IP temporarily according to the time set in “How long is an IP address blocked when it breaks a rule“.

I was not aware of this. Breaking the rules is being taken care of by WF automatically as per my settings in Rate Limiting Options. Logically, BLOCK THIS IP should permanently block it. I suggest that if this is not the case, it needs to be made very clear on that page. ??

That blocked IP I was referring to no longer appears in Live Traffic. I do have a screenshot of its earlier access AFTER it was blocked, however I’d rather not post it on a public forum. It shouldn’t appear any more as I have manually blocked it in my cpanel Blocked IPs Manager where it is permanently blocked from accessing my website at the server level.

But now I have found a new curiosity…

I tried to block an IP in Live Traffic which was persistently trying to access a non-existing file – and I couldn’t, getting an error message which says that “This IP address is in a range of IP addresses that Wordfence does not block”. Could you please explain this?

many thanks

Hi,
– Wordfence doesn’t add Blocked IPs in “.htaccess” file, unless you are running an old version of the plugin (with Falcon cache? this was discontinued long time ago).

– If an IP that you have blocked via cPanel is still showing up in the Live Traffic, then I think you will have to report this issue to your hosting provider.

– Please share this IP address with me so I can check why it can’t be blocked.

Thanks.

HI

I have the current version of Wordfence 6.3.22

I can assure you that there is no other way the IPs I blocked in my WF would show up in my Blocked IPs Manager in my CPanel – as I did NOT put them there manually. AND my website host confirmed that WF write to my .taccess file. so while you say that’s not possible – well, I have the evidence right in front of me….

but it’s not a critical issue, so we can leave it.

That blocked IP is no longer showing in Live Traffic. It was showing few days ago AFTER I bloked it in WF – but I have since blocked it in my cpanel.

I don’t have that IP recorded – but since the message said specifically that “This IP address is in a range of IP addresses that Wordfence does not block” – what is the range of IPs that WF doesn’t block, generically speaking? are there ANY IPs that WF doesn’t block aand if so – why?

thanks

Hi @magicpowers
Sorry for replying here too late, I was going through all threads replied by me and I noticed I missed this one by mistake, I apologize for that.

Yes, Wordfence modifies “.htaccess” file to add the firewall optimization code, if you can see IPs blocked there by Wordfence, then most probably that were leftovers from one of the old versions, it’s not actually valid anymore, the current version doesn’t block IPs in “.htaccess” file.

Wordfence will not allow you to block “Private Addresses“, our own servers’ addresses and other servers’s addresses like (Facebook, Sucuri, UptimeRobot and StatusCake), all these IPs can be found in (wordfence/lib/wfIPWhitelist.php).

Thanks.