{"id":83,"date":"2021-04-07T21:37:08","date_gmt":"2021-04-07T21:37:08","guid":{"rendered":"https:\/\/bandittracker.com\/?p=83"},"modified":"2021-04-07T21:38:44","modified_gmt":"2021-04-07T21:38:44","slug":"how-to-block-an-ip-address-in-wordfence","status":"publish","type":"post","link":"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/","title":{"rendered":"How To Block An IP Address In Wordfence (With Pictures)"},"content":{"rendered":"\n<p>You can block specific IP addresses with the free version of the Wordfence plugin. The paid version gives you some extra options for handling unwanted traffic.<\/p>\n\n\n\n<p>This article gives you a step-by-step walkthrough on how to block an IP Address with Wordfence. If you know the exact deatils, you can jump to <a href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#How_To_Block_An_IP_In_Wordfence_Directly\">the section on blocking a single IP address<\/a>. <\/p>\n\n\n\n<p>But Wordfence also helps you review suspicious traffic, and block as you investigate. So we&#8217;ll start there.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_64 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-66114d9736616\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-66114d9736616\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#Viewing_The_IP_Addresses_Of_Failed_Logins\" title=\"Viewing The IP Addresses Of Failed Logins\">Viewing The IP Addresses Of Failed Logins<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#Wordfence_Live_Traffic_View\" title=\"Wordfence Live Traffic View\">Wordfence Live Traffic View<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#Checking_Recent_Traffic\" title=\"Checking Recent Traffic\">Checking Recent Traffic<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#Using_the_Wordfence_%E2%80%9CRun_WHOIS%E2%80%9D_Button\" title=\"Using the Wordfence \u201cRun WHOIS\u201d Button\">Using the Wordfence \u201cRun WHOIS\u201d Button<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#Use_%E2%80%9CBlock_This_Network%E2%80%9D_To_Block_An_IP_Range\" title=\"Use \u201cBlock This Network\u201d To Block An IP Range\">Use \u201cBlock This Network\u201d To Block An IP Range<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#How_To_Block_An_IP_In_Wordfence_Directly\" title=\"How To Block An IP In Wordfence Directly\">How To Block An IP In Wordfence Directly<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#Alternatives_To_Wordfence_%E2%80%93_The_DIY_Approach\" title=\"Alternatives To Wordfence \u2013 The DIY Approach\">Alternatives To Wordfence \u2013 The DIY Approach<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/#How_To_Block_A_Country_In_Wordfence\" title=\"How To Block A Country In Wordfence\">How To Block A Country In Wordfence<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Viewing_The_IP_Addresses_Of_Failed_Logins\"><\/span>Viewing The IP Addresses Of Failed Logins<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The Wordfence Firewall dashboard shows you plenty of snapshots of blocking activity. You\u2019ll see aggregated numbers of blocking by country, and the top four IP addresses by how many times they\u2019ve been blocked. <\/p>\n\n\n\n<p>Further down the page, you\u2019ll find the most recent failed logins (you need to toggle the view from \u201cSuccessful\u201d to \u201cFailed\u201d. Here\u2019s a recent view of mine:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"486\" height=\"368\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/failed_admin_login_attempts.png\" alt=\"list of failed login attempts with IP addresses\" class=\"wp-image-79\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/failed_admin_login_attempts.png 486w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/failed_admin_login_attempts-300x227.png 300w\" sizes=\"(max-width: 486px) 100vw, 486px\" \/><\/figure><\/div>\n\n\n\n<p>The frequent attempts aren\u2019t the only giveaway of a bad bot. I always remove the \u201cadmin\u201d account from my WordPress sites, so nobody should be using that login.<\/p>\n\n\n\n<p>The views on the Firewall page are purely for display purposes. You don\u2019t take action from here.<\/p>\n\n\n\n<p>The Live Traffic view gives you ways to deal with specific IP addresses.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Wordfence_Live_Traffic_View\"><\/span>Wordfence Live Traffic View<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>You access the view of Live Traffic via the \u201cTools\u201d page.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"692\" height=\"342\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/live_traffic_page.png\" alt=\"\" class=\"wp-image-84\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/live_traffic_page.png 692w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/live_traffic_page-300x148.png 300w\" sizes=\"(max-width: 692px) 100vw, 692px\" \/><\/figure><\/div>\n\n\n\n<p>A new installation of Wordfence sets the traffic logging to \u201cSecurity Only\u201d. This means that only a restricted type of hit on your website are scanned and logged:<\/p>\n\n\n\n<ul><li>Successful logins<\/li><li>Unsuccessful login (invalid passwords)<\/li><li>IP Addresses that are blocked by the premium IP blacklist<\/li><\/ul>\n\n\n\n<p>You won\u2019t see normal traffic to the rest of your website with this setting. This means that if a bot is hammering your pricing page and slowing response times to potential buyers, you don\u2019t see that activity here.<\/p>\n\n\n\n<p>However, this restricted type of logging is much better for the overall performance of your site. I wrote an article addressing <a href=\"https:\/\/bandittracker.com\/does-wordfence-slow-down-your-website-complete-guide\/\">whether Wordfence slows down your website<\/a>. The default settings of logging used to be \u201cAll Traffic\u201d out of the box. When Wordfence switched the default to security, that addressed the performance problems.<\/p>\n\n\n\n<p>However, you can toggle logging over to \u201cAll Traffic\u201d temporarily. This lets you observe what\u2019s going on and which pages are being targeted. Once you\u2019ve gathered the info you need, don\u2019t forget to switch back to the less heavy process. To be fair to Wordfence, they\u2019ll pop up a reminder if you leave the setting on \u201cAll Traffic\u201d.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Viewing All Traffic With Wordfence<\/h3>\n\n\n\n<p>Once you\u2019ve toggled the logging mode, scroll down to watch the traffic.<\/p>\n\n\n\n<p>Here are two recent entries on one of my sites. The first is identified by Wordfence as a Human. The plugin isn\u2019t infallible with this assessment. Plenty of bots try to behave like humans. And I\u2019ve noticed that Wordfence occasionally logs my own activity as that of a bot.<\/p>\n\n\n\n<p>Beneath the human, we see an identified bot. This is where you need to be careful. There are plenty of bots that you will want to welcome to your website with open arms. This example is the Feedly service, which is reading the RSS feed. Sometimes I disable the RSS feed, but I want it in this case.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"747\" height=\"340\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/human_and_bot.png\" alt=\"\" class=\"wp-image-85\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/human_and_bot.png 747w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/human_and_bot-300x137.png 300w\" sizes=\"(max-width: 747px) 100vw, 747px\" \/><\/figure><\/div>\n\n\n\n<p>You will also see a nice big blocky button that lets you block the IP address with ease. Clicking the Block IP button takes immediate effect. You\u2019re not asked if you\u2019re sure! You can also undo or unblock immediately, but it\u2019s best to do a little research before you take drastic action.<\/p>\n\n\n\n<p>That research should include checking the WHOIS entry for this I.P. address. Thankfully, Wordfence gives us the option to do so \u2013 right beside the Block button.<\/p>\n\n\n\n<p>But before I check the WHOIS information, I usually want to look more closely at the activity of this particular user. So, I use the third button as the next step \u2013 that\u2019s the button marked \u201cSEE RECENT TRAFFIC\u201d.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Checking_Recent_Traffic\"><\/span>Checking Recent Traffic<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>It\u2019s important to get some quick context before you block the offending IP addresses.<\/p>\n\n\n\n<p>For example, suppose I was worried about one of the bots I showed earlier. The recent traffic activity shows me that the only area it\u2019s hitting on my website is the \/feed\/.<\/p>\n\n\n\n<p>That should give me more context to see that this is an RSS reader.<\/p>\n\n\n\n<p>However, suppose I saw activity hammering a PHP script instead of an HTML page. Then I\u2019d get worried. At this point, I\u2019d do some quick research to see if others were reporting this attack.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Using_the_Wordfence_%E2%80%9CRun_WHOIS%E2%80%9D_Button\"><\/span>Using the Wordfence \u201cRun WHOIS\u201d Button<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>When you click the \u201cRun Whois\u201d button, Wordfence reaches out to the WHOIS Lookup service for the information. You can do this yourself (it\u2019s all free) but Wordfence saves you a few steps.<\/p>\n\n\n\n<p>The Wordfence page can be a little slow to display the information, so you may need to wait a few seconds. If you haven\u2019t looked at WHOIS before, I\u2019ll take you through what you need to glean from it. I clicked on \u201cRun WHOIS\u201d on my own entry in Live Traffic. Here is part of it.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"694\" height=\"185\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/whois_email.png\" alt=\"\" class=\"wp-image-86\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/whois_email.png 694w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/whois_email-300x80.png 300w\" sizes=\"(max-width: 694px) 100vw, 694px\" \/><\/figure><\/div>\n\n\n\n<p>There\u2019s some repeated information, but Wordfence helpfully makes the contact email address a link so it should show up in blue. In my case, the email address is provided by my broadband service provider. This is where they want bot traffic attacks reported.<\/p>\n\n\n\n<p>At some point, you can compose an email to report the problem to the owner of the IP addresses. But if you\u2019re in the middle of a bot attack, you probably have higher priorities. Like blocking the attack and protecting your website immediately.<\/p>\n\n\n\n<p>Wordfence also provides an IP address range. It\u2019s quite a wide range with over 64K addresses.<\/p>\n\n\n\n<p>When I scroll down a little, I see a smaller range mentioned. The <a href=\"http:\/\/www.wordfence.com\" target=\"_blank\" rel=\"noreferrer noopener\">Wordfence documentation<\/a> suggests you restrict the smaller option.<\/p>\n\n\n\n<p>Whichever you choose, you can block the IP range via the \u201cBLOCK THIS NETWORK\u201d button beside it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Use_%E2%80%9CBlock_This_Network%E2%80%9D_To_Block_An_IP_Range\"><\/span>Use \u201cBlock This Network\u201d To Block An IP Range<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Unlike blocking a specific IP address, the &#8220;BLOCK THIS NETWORK&#8221; block button doesn\u2019t take effect immediately. It takes you to a page to confirm the blocking rule. This lets you edit details like the specific range before you take action.<\/p>\n\n\n\n<p>If you choose to keep the details, you should add a Block Reason. This lets you keep track of your actions. If you\u2019re under pressure with multiple attacks, you\u2019ll be thankful later.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_To_Block_An_IP_In_Wordfence_Directly\"><\/span>How To Block An IP In Wordfence Directly<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>We&#8217;ve showed how to use the Live Traffic display to jump to blocking IP ranges. But what if you know the IP address and you want to jump straight to kicking it off your website? You don&#8217;t need to monitor activity first.<\/p>\n\n\n\n<p>Open the Firewall page and choose the Blocking tab. This is where you can create different types of blocking rules. We&#8217;ve already seen the third tab, the &#8220;Custom Pattern&#8221;. This is where the &#8220;BLOCK THIS NETWORK&#8221; button landed us, with the details prepopulated.<\/p>\n\n\n\n<p>This time, we&#8217;re going to leave it on the default IP Address tab.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"558\" height=\"321\" src=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/block_single_ip_address.png\" alt=\"\" class=\"wp-image-87\" srcset=\"https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/block_single_ip_address.png 558w, https:\/\/bandittracker.com\/wp-content\/uploads\/2021\/04\/block_single_ip_address-300x173.png 300w\" sizes=\"(max-width: 558px) 100vw, 558px\" \/><\/figure><\/div>\n\n\n\n<p>Enter the IP address and a block reason, and drop that ban hammer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Alternatives_To_Wordfence_%E2%80%93_The_DIY_Approach\"><\/span>Alternatives To Wordfence \u2013 The DIY Approach<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>You don\u2019t actually need a WordPress plugin to block IP addresses.<\/p>\n\n\n\n<p>WordPress websites have a hidden access file in which you can enter IP addresses to be blocked. This is the .htaccess file.<\/p>\n\n\n\n<p>You should have some web administration experience before you go editing these hidden files. It\u2019s quite possible to bring down your site with a mistaken edit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_To_Block_A_Country_In_Wordfence\"><\/span>How To Block A Country In Wordfence<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The premium upgrade allows you to block access at country level. If you\u2019re feeling overwhelmed by successive attacks from the same country, this is a good option even if just as a holding operation.<\/p>\n\n\n\n<p>Once you\u2019ve got the wide block in place, you can continue to review the activity and patterns. This may help you localize the problem to a more specific range of IP addresses.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>You can block specific IP addresses with the free version of the Wordfence plugin. The paid version gives you some extra options for handling unwanted traffic. This article gives you a step-by-step walkthrough on how to block an IP Address with Wordfence. If you know the exact deatils, you can jump to the section on &#8230; <a title=\"How To Block An IP Address In Wordfence (With Pictures)\" class=\"read-more\" href=\"https:\/\/bandittracker.com\/how-to-block-an-ip-address-in-wordfence\/\" aria-label=\"More on How To Block An IP Address In Wordfence (With Pictures)\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[3,5],"tags":[],"_links":{"self":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/83"}],"collection":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/comments?post=83"}],"version-history":[{"count":4,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/83\/revisions"}],"predecessor-version":[{"id":92,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/posts\/83\/revisions\/92"}],"wp:attachment":[{"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/media?parent=83"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/categories?post=83"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bandittracker.com\/wp-json\/wp\/v2\/tags?post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}