WhiteList automatically ALL WooCommerce Clients

  • Resolved RobinK

    (@robin2014)


    2 years, 9 months ago

    Hello Support,

    I’m have issues between the firewall rules to block too many login attempts, and Lock IP out during X minutes, or days, or months. to prevent brute force attacks indeed,

    BUT problem is with real clients that often make mistakes to login, and they get locked-out for the defined period of time.

    SO, To avoid that, is there a way to Whitelist ALL Woocommerce client username or emails or both to avoid Locking them out, event if they do more than X attempt to login ?

    Any advice to solve this kind of case, would be much appericated.

    Best regards,
    Robin.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @robin2014, thanks for your question.

    We generally don’t recommend utilising features like “Allowlisted IP addresses that bypass all rules” unless absolutely necessary as this allows all Wordfence protection to be bypassed. Regardless, most of your users won’t have fixed IPs but I just wanted to mention it.

    It may be worth loosening the “too many login attempts” restrictions slightly to a level that may be considered reasonable for a human to accidentally mistype or momentarily forget their credentials. They may also be inadvertently be caught out with a typo by the “immediately lock out invalid usernames” setting in Wordfence > All Options > Brute Force Protection. We would recommend this be disabled if you have a high quantity of users/customers accessing an online store.

    I generally set my Rate Limiting rules to these values to start with:
    Rate Limiting Screenshot

    • If anyone’s requests exceed – 240 per minute
    • If a crawler’s page views exceed – 120 per minute
    • If a crawler’s pages not found (404s) exceed – 60 per minute
    • If a human’s page views exceed – 120 per minute
    • If a human’s pages not found (404s) exceed – 60 per minute
    • How long is an IP address blocked when it breaks a rule – 30 minutes

    I also always set the rule to Throttle instead of Block. Throttling is generally better than blocking because any good search engine understands what happened if it is mistakenly blocked and your site isn’t penalized because of it. Make sure and set your Rate Limiting Rules realistically and set the value for how long an IP is blocked to 30 minutes or so.

    With Brute Force settings, I recommend trying 3-5 for attempts and password resets, counted over 4 hours, with a 30 minute (or longer) lockout time period.

    Remember there is no hard and fast, one size fits all set of rules for every site. This is just a good place to start.

    Let me know how that goes for you!

    Peter.

    Thread Starter RobinK

    (@robin2014)

    thanks for the insight, your settings are a might different than the regular recommended settings, I guess you’ve worked some time on it
    but I’m trying your now.

    Best
    Robin

    Plugin Support wfpeter

    (@wfpeter)

    Hi @robin2014,

    Let me know how you get on after trialling those for a while. Typically topics here on the forums will be open for 7 days without response, but I’m refreshing that now so you have a little more time to see how they’re working for you.

    Thanks again,

    Peter.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘WhiteList automatically ALL WooCommerce Clients’ is closed to new replies.