Luke Boobyer

That’s perfect thanks for reply, looking forward to 4.2.

Thanks yes that answered my question nicely.

So after a bit more testing this does kind of work, but not as I would expect.

If I load my page straight away after clearing the full Cloudflare cache, then reload the page before the max-age value then the page is served from my local disk cache https://snipboard.io/nyxO06.jpg
https://snipboard.io/zwLMOI.jpg

But if I visit the page outside the max-age value and reload the page, then it is served from Cloudflare by the looks of it:
https://snipboard.io/L0uH1j.jpg
https://snipboard.io/PH2paZ.jpg

Have I misunderstood how max-age should work?

The shortcode has been put back in now so you can see it in action.

We’re using 1.8.5

That’s brilliant thanks for the detailed reply Phil.

That’s great thanks for pushing out an update so quickly.

That’s great thanks Tevya, I’ll update and check if it’s all fixed.

Yes the hits show either “attempted a failed login using an invalid username” or “attempted a failed login as”

So for example recently the following IP 113.59.217.94 from Colombo, Sri Lanka made 11 failed login attempts, all hits showing one of the above messages, within the space of 2 minutes.

With the settings I have in place for brute force protection I would expect that IP to be blocked after the 8th attempt.

Great thanks for the update @thefiddler.