🚫 Blocked IPs
This section shows all IP addresses that have been automatically blocked by SeenSecure's protection systems. Each IP includes information about the block type, its duration, and the module that triggered it.
Block Types
WAF
Blocked by the Web Application Firewall upon detecting attack patterns such as SQLi, XSS, or LFI in the request.
Rate Limiting
Blocked for exceeding the allowed request limit within a time window (escalated by levels).
Bot Protection
Blocked for typical bot behaviors: HTTP/1.0 without Host, empty User-Agent, missing Accept-Language, CLI tools.
Geo-Blocking
Blocked for belonging to a restricted country in the geo-location configuration.
Injection
Blocked by the anti-injection shield upon detecting malicious payloads in parameters, cookies, or headers.
Duration Badges
Each blocked IP shows a badge indicating whether the block is Permanent (never expires until manually unblocked) or Temporary (with remaining time visible).
Escalation Levels — Rate Limiting
Rate limiting automatically escalates block duration based on each IP's violation frequency:
| Violation | Block | Description |
|---|---|---|
| 1st | Temporary (15 min by default) | First violation: short block. |
| 2nd (within the memory window) | Temporary, longer (2 hours by default) | Repeat violation within the configured window. |
| Reaches the configured threshold (5 violations by default) | Permanent | The IP is automatically moved to the blacklist. |
The duration of each block, the number of violations before a permanent block, and the time window ("memory") are configurable in Firewall → Rate Limiting → Progressive escalation. If the IP doesn't offend again within the configured window, its violation history resets.
Per-Row Actions
- Unblock: Removes the temporary or permanent block on the IP. The IP will be able to access the site again.
- Details: Shows complete IP information: block reason, date, module, detected payload, user-agent, headers, and attempt count.
Bulk Actions
Select multiple IPs and apply an action to all of them simultaneously:
- Unblock: Unblocks all selected IPs.
- Move to Blacklist: Adds the selected IPs to the blacklist as a permanent block with source tracking.
- Extend: Adds 1 hour or 24 hours (two separate menu options) to the temporary block of selected IPs.
- Make Permanent: Converts the selected temporary blocks into permanent blocks.
- Export: Exports the selected IPs in CSV or TXT format for external analysis.
Block Response Mode
You can choose how the server responds when a blocked IP tries to access:
- Full Screen: Shows an informative HTML block page with the reason, incident ID, and a support link. Recommended for production.
- Mini 403: Responds with only HTTP 403 code and a simple text message. Faster but less informative. Useful for high-performance environments.
⛔ Blacklist
The blacklist contains IPs with permanent blocks. These IPs cannot access the site under any circumstances, unless manually removed from the list.
Addition Sources
| Source | Description |
|---|---|
| Manual | Added manually by an administrator from the IP Management panel. |
| Firewall Event | IP automatically added after critical firewall events (multiple WAF violations). |
| Repeated Attacks | An IP that hit the escalation threshold is marked as a permanent block in Blocked IPs — it is not moved to the Blacklist automatically; you can move it yourself with the "Move to Blacklist" bulk action. |
| Threat Intel | IP reported on public threat lists (Spamhaus, etc.) and automatically blocked. |
Per-Row Actions
- Remove: Removes the IP from the blacklist. The IP will no longer be permanently blocked.
- Details: Shows the complete IP history: addition date, source, reason, associated events, and number of blocked access attempts.
Bulk Actions
- Remove: Removes all selected IPs from the blacklist.
- Move to Whitelist: Transfers the selected IPs from blacklist to whitelist as trusted IPs.
- Extend: For blacklist with custom expiration (if configured), adds additional time.
- Make Permanent: Ensures the selected IPs remain on the blacklist indefinitely.
- Export: Exports the selected IPs in CSV or TXT format.
Legacy Schema Support
If you upgraded from a previous version of the plugin, the blacklist may contain records with old column names. The system automatically recognizes and normalizes both schemas:
| New Field | Legacy Field | |
|---|---|---|
reason |
label |
Block reason |
added_at |
created_at |
Addition date |
You don't need to do anything — the plugin handles both formats transparently. New records are always saved with the updated schema.
✅ Whitelist
The whitelist contains trusted IPs that will never be blocked by any SeenSecure module. IPs on this list completely bypass the firewall protection chain.
Indicators
- Trusted Indicator: Each whitelisted IP shows a green badge indicating its trusted status.
- Source Tracking: Shows how the IP was added (manual, imported, API, etc.).
- Last Seen Activity: Date and time of the last logged access from that IP. Helps identify unused IPs.
Per-Row Actions
- Remove: Removes the IP from the whitelist. From that point on, it will be subject to all protection modules.
- Details: Shows complete whitelisted IP information: addition date, source, last activity, logged bypass events, and associated configuration.
Bulk Actions
- Remove: Removes all selected IPs from the whitelist.
- Move to Blacklist: Transfers the selected IPs from whitelist to blacklist as a permanent block.
- Export: Exports the selected IPs in CSV or TXT format.
🔧 Troubleshooting
One of my IPs shows blocked even though I didn't add it to the blacklist
Besides your local blacklist, if you have the Protection Network enabled, your site can also block IPs published by the community (not managed here). Either way, the local whitelist always takes absolute priority: add the IP here and it will bypass any other block, no matter where it came from.
I need to block an IP permanently and quickly
Add it directly to the Blacklist. If it's already on the Whitelist by mistake, use the "Move to Blacklist" bulk action instead of removing it and adding it again by hand.
Frequently Asked Questions
What happens if an IP is on both the whitelist and the blacklist? It shouldn't happen in normal use (adding to one list doesn't automatically remove it from the other), but if it does, the whitelist takes priority: a trusted IP is never blocked.
Does the whitelist also let me skip logging into WordPress? No. It only bypasses the firewall protection modules (Anti-Bot, Rate Limiting, etc.); WordPress authentication and user permissions still apply normally.
How do I know if an IP on the list was added manually or by the system? The "Source Tracking" column shows the exact origin: manual, imported, API, etc.