Hi,
How long is your block time rule set? The blocks will eventually expire. The default time is 5 minutes. Also, keep in mind attackers can change their IP addresses and then attempt with the same username again.
If they use the same name to login, from the same IP, within the block time you have set, then they will be blocked.
-Brian
Thread Starter
new_B
(@new_b)
Thanks, WFBrian for the further info. The time a user is locked out is 1 day.
To clarify, under the Logins and Logouts tab for Live Traffic attempts, I see an entry like the following:
Bacoor, Philippines attempted a failed login using an invalid username “admin”.
IP: 180.191.134.249 [block]
I have “admin” as one of the user login attempts to block right away.
=> Please correct me if this assumption is wrong. I would assume that WordFence would see this and add it to the blocked list at /wp-admin/network/admin.php?page=WordfenceBlockedIPs. I don’t see this happening. I checked with a recent attempt (within a few min.)
Thanks for any help/insight you can provide.
Yes, normally when a user is locked out from logging in, you should see them on the “Wordfence Blocked IPs” page that you mentioned, on the second tab, “IPs that are Locked Out from Login” — they don’t necessarily get blocked from the whole site. (If a real user is locked out from login, that way they can still find your contact information elsewhere on the site.)
If they don’t even show up on this type, it might be a different type of login, through xmlrpc. If you can find the visits from that IP address you mentioned in your site’s access log, you could confirm if that is the type (you’ll see xmlrpc.php in the URL). We are working on improved blocking for this type of login in a future version.
Thread Starter
new_B
(@new_b)
Looks like it was via xmlrpc.
Ok — the xmlrpc blocking mentioned above has been implemented in version 6.0.17 since my last reply, so these should be blocked going forward, if you have updated to the latest version. If you have any additional trouble, let us know. Thanks!
-Matt R
