SeenSecure Help
EspañolEnglishDeutschFrançais

Protection Network

The SeenSecure community protects all its members: each site anonymously reports the blocks it has already executed and receives the collaborative blocklist of IPs confirmed by multiple sites.

Protection Network Overview

The Protection Network is SeenSecure's collaborative component. Unlike Threat Intelligence (IP lists published by third parties), the Network is built from evidence gathered by PRO clients themselves: when your site blocks an attack, it can report it anonymously to the central service. The server cross-checks reports from all sites, scores each attacking IP and publishes in the feed only IPs confirmed by several different sites.

What it brings

Your site benefits the rest of the community and receives protections learned from attacks it has not yet suffered.

What it is not

It does not track visitors or send personal data. Only evidence of an already executed block is shared.

Requirements

Active PRO license. Legal basis: legitimate security interest (Art. 6.1.f GDPR), with the option to disable reporting at any time.

How It Works

Data flow

  1. Report: every temporary block your site executes (rate limiting, WAF, header protection…) is queued locally and sent to the central service in automatic batches.
  2. Analysis: the server deduplicates events, scores each IP and weights each site's reliability. An IP's weight decays over time until the evidence is no longer useful.
  3. Publication: an IP enters the feed only with strong, repeated evidence from several different sites. Coordinated campaigns hitting several sites at once are published immediately.
  4. Feed: your site downloads the delta periodically (configurable frequency) and blocks those IPs at runtime, before they even reach you.

Mandatory contribution

The Network works as mutual collaboration: you only receive the blocklist if your site contributes with its reports. Without active reporting, receiving stays disabled — disabling reporting automatically disables receiving.

Lifecycle of a published IP

  • Automatic removal: if an IP stops being used for attacks, its score decays and it is marked inactive; the next feed removes it from every client's local blocklist.
  • Expiry: every published IP automatically leaves the feed after a limited period, with no manual intervention.

Network console (statistics and history)

At Firewall → Threat Intelligence → Protection Network you will find the Network summary with KPI cards: active blocked IPs (including how many are on the blocklist because they were reported by several distinct sites), connected sites, events in the last 24 h and global blocks. The tabs break down the published IP list, the sites and the event history.

Each published IP has its own detail view with a full history: who reported it first and in what order, how many sites currently block it via feed and the detail of each report. The summary also feeds a WordPress dashboard widget with your site's and the Network's statistics, manually refreshable.

Troubleshooting

  • The Protection Network section does not appear: it is under Firewall → Threat Intelligence. If you cannot see it, verify that the PRO license is active (Network features are PRO).
  • Reporting cannot be enabled: reporting is on by default after the initial connection notice — if you turned it off manually ("Disable reporting" button), just turn it back on from the Protection Network section. No checkbox needs to be checked first.
  • The report queue does not empty: check "Last error" in the section. An http_429 error means the server limit was exceeded (it retries automatically). no_token means the license did not validate — check the PRO license.
  • "Active blocked IPs" is 0: the blocklist is a receiving benefit: enable "Receive blocklist". The network needs a minimum number of reporting sites before publishing confirmed IPs.
  • A legitimate visitor was blocked: the fastest fix is to add their IP directly under Firewall → IP Lists (local whitelist): it takes absolute priority and bypasses the Network blocklist entirely, without touching "Receive blocklist" or waiting for the next sync. Also email privacy@seensecure.com if you believe the IP shouldn't have been published, so it can be reviewed at the source.
💡 Why this can happen: if you manage several of your own sites and use them to run security tests against each other (e.g. authorized scans), your own IP can end up reported by more than one of your sites at once, just like any other IP with repeated activity. Add it to the local whitelist on each site before running that kind of test to avoid it.
PRO The Protection Network is an exclusive PRO feature in its entirety (report and blocklist). Sites without a PRO license can view the section but cannot enable any option. Upgrade to PRO from SeenSecure → License or at seensecure.com/pricing.

Frequently Asked Questions

Can I receive the blocklist without reporting my own blocks? No: contribution is mandatory by design. You only receive the blocklist if your site also reports — disabling reporting automatically disables receiving.

How many reports does it take to publish an IP? Never just one: it takes several distinct, independent sites reporting it within a short window, precisely so a single mistaken or malicious report can't contaminate everyone's protection.

How long does a published IP stay published? A maximum of 7 days from publication, and it's removed sooner if its activity decays and it stops being an active threat — no manual action needed.

Is the domain that reports an IP shared? Never. Only the blocked IP, the type and reason for the block, and the originating site are shared internally for the calculation — the reporting domain is never made public.