Sensors and blocking
Sixteen sensors watch the sign-in form, XML-RPC, the REST API, the forms and the request itself. A sensor that reaches its threshold blocks the address on an escalation ladder, logs the event and, in the Community Network, reports it. This page lists every sensor with its default and explains what decides a block.
The sixteen attack sensors
Every sensor has its own switch and thresholds under Core protection → Detection & Thresholds, the form sensors under Forms. Three rows of the table are companions rather than sensors of their own: the bait paths report instead of blocking, Hide Login is an access switch, and the escalation ladder is the response every sensor feeds. All sixteen are part of the free plugin.
| Sensor | What it watches | Default |
|---|---|---|
| Brute-force sign-in | Failed sign-ins per address through wp_login_failed. | 5 in 15 min |
| Password spraying | Different user names tried from one address, the low-and-slow pattern. | 5 in 10 min |
| Comment spam | Every comment is scored on about twenty signals: links and how much of the text they take, distinct domains, disposable mail domains, giveaway top-level domains, a domain or digits in the author name, foreign script, the language of the text against the site language, a praise opening next to a link, a link target or a text that arrived before, a missing user agent or form field. Several signals have to agree. A scored comment goes to spam (default), is refused, or is left to WordPress. A comment waiting for moderation is not counted. | Score 7; 3 spam comments in 24 h block the address |
| XML-RPC abuse | XML-RPC calls per address through xmlrpc_call. | 10 in 60 min |
| REST burst | Anonymous REST requests per address. The consent banner namespaces real-cookie-banner, complianz, borlabs-cookie and cookie-law-info are skipped. Signed-in users never count. | 240 in 5 min |
| 404 and scanner | Bursts of 404 responses, and at once a request for a probe path such as .env, .git/config or wp-config.php.bak. | 12 in 2 min |
| Bait paths | Paths no real visitor asks for (.env.backup, wp-config.old.php, ...). One hit returns a 403 and queues a high-severity community report, without a local block, so a backup plugin writing such a file cannot lock the site out of itself. On Apache a marker block above # BEGIN WordPress routes real files of that name through WordPress; nginx gets a snippet. | 1 hit = 403 and report |
| Web application firewall | URI, query string, body and user agent against the active ruleset. See Firewall and WAF. | Paranoia Level 1 |
| Verified bots | A request that claims to be Googlebot, Bingbot or another large crawler is checked against the crawler's published ranges, then by forward-confirmed reverse DNS. A fake is flagged or blocked; a real crawler is never blocked. | Flag in Local Shield, block in the Community Network |
| Registration defence | One rule set for every sign-up path. See Registration rules. | Rate limit 3 in 60 min |
| Form execution proof | An invisible decoy field plus a field a small script adds, on the comment, sign-up and password-reset forms and on Contact Form 7. See Forms and spam. | On |
| Community check on forms | The address of a comment, sign-up or password reset is checked against the community at the same protection level as the sign-in. Fails open on a timeout or an exhausted quota. Community Network only. | On in the Community Network |
| User enumeration | Blocks ?author=N, /wp-json/wp/v2/users and oEmbed user lookups, and gives the same error for a wrong user name and a wrong password. Author archives can stay public with a separate switch. | 5 in 5 min |
| Application passwords | Failed application password sign-ins per address, which closes the Basic Auth path around 2FA. | 5 in 15 min |
| Login anomaly | Country and network of a successful sign-in against the user's history of 90 days; a new one can revoke the trusted devices, so the next sign-in asks for the second factor again. Needs the reputation data of the Community Network. | On |
| Password policy | Minimum length and character classes for the covered roles, optionally a breach check against Have I Been Pwned (only the first five characters of the SHA-1 hash leave the site). | 12 characters; breach check off |
| Hide Login | A custom sign-in address instead of wp-login.php; the old address answers with a block page or a 404. Repeated hits on the old address from one address count as a scan. | Off; slug 3 to 50 characters |
| Block escalation | The ladder every sensor feeds, see below. | 5 min to 7 days |
| WooCommerce sign-in | Failures on the My Account and checkout sign-in count toward the brute-force counter. | As brute-force |
The server's own addresses are never blocked automatically, so a cache preloader or a WP-Cron loopback cannot lock the site out of itself. An address on the whitelist is never blocked by any layer.
Block escalation
Repeat offenders pay more. The default ladder is 5 min, 15 min, 30 min, 24 h, 48 h, 7 days. After 30 quiet days an address starts at the first step again. A visitor who tripped a threshold by mistake, behind a carrier NAT or with a typo, is back in minutes; a persistent attacker reaches the seventh day. A loud burst can buy several steps at once. Ladder, reset window and switch are under Blocking & Escalation; with the ladder off, the fixed block duration applies.
Report-only mode logs and reports every detection but blocks nothing, which helps when you tune thresholds on a busy site. The whitelist form has an Add my IP helper; for a rotating IPv6 connection add your /64 range instead of a single address.
Community reputation
In the Community Network the address of a sign-in attempt, and of a comment, sign-up or password reset, is checked against the community. From the protection level on (75 % by default, never below 25 %) it is refused and blocked locally for 24 hours. Addresses the community knows as infrastructure, your own server and whitelisted addresses are never refused this way. When the service does not answer, one timeout pauses live lookups for two minutes and the site fails open meanwhile. Confidence score explains how the value is calculated.
Hardening mode during attack waves
Part of the Pro add-on from the Professional plan. When several addresses attack the sign-in at once, the
hardening mode tightens the failed sign-in and reputation thresholds network-wide for one hour and extends
the window while the wave lasts. It is on from the Professional plan and tuned under Advanced → Attack
Response, and wp reportedip hardening shows, starts or ends it by hand.
Tor exit nodes
Part of the Pro add-on from the Professional plan, in the Community Network. The switch under
Blocking & Escalation is off by default. The exit node list arrives as a signed ruleset and
is refreshed twice a day; the community flag covers addresses the list has not caught up with. Tor blocks
last 24 hours (filter reportedip_hive_tor_block_hours), are never reported, because running an
exit node is no evidence of abuse, and never touch a whitelisted address.
Group bans
Part of the Pro add-on from the Professional plan, in the Community Network. A Community Access Key can belong to a group in your account. The plugin fetches the group list every fifteen minutes and mirrors it as blocks of the type Group Ban, until the expiry the service names. An entry that leaves the list is lifted, and the group whitelist arrives as whitelist entries with the origin Group. The whitelist wins as always, and a block placed by hand is never touched. Group bans are not a sensor.
The dashboard shows a group card, and Activity → IP Lists → Group shows every
address of the list with the member that reported it and what this site made of it: blocked by the group,
already blocked, whitelisted, the own server, report-only mode, window over or lifted by hand. Every sync that
changes something writes one group_list_synced row. A plan without groups, a key that leaves its
group, Local Shield or a deactivated add-on remove everything the group placed on the site.
Last updated: · Maintained by the ReportedIP team