Threat Intelligence Overview
Threat Intelligence collects feeds of malicious IP addresses from trusted sources and SeenSecure's own telemetry network. These lists are automatically updated every hour, allowing your site to block known attackers before they can execute any action.
What it includes
- Threat lists from the centralized SeenSecure API
- Spamhaus DROP (Don't Route Or Peer) feeds
- Updated Tor exit node list
Key benefits
- Proactive blocking: stops attackers before they touch your site
- Automatic hourly updates with no manual intervention
- Drastically reduces log noise and false positives
threat_intel.threat_lists — Manage malicious IP sources and their updates.
Threat Lists
Threat lists are sets of IP addresses that have been identified as malicious by trusted sources. SeenSecure integrates two main sources:
Centralized SeenSecure API
SeenSecure maintains a centralized API that collects anonymous telemetry from all sites running the plugin: what kind of attack was blocked, how severe it was, and from which IP. The system analyzes these signals — frequency, severity, and agreement across different sites — before deciding whether an IP makes it into the global list. By design, no single site's report is ever enough to get an IP blocked network-wide: it's only published once several distinct, independent sites flag it within a short window, precisely so one mistaken (or malicious) report can't contaminate protection for everyone else. Each IP's score also decays over time, so a threat that stops being active eventually drops off the list on its own. The full detail of how reporting, scoring, and retirement work is on the Protection Network page.
Spamhaus DROP Feeds
Spamhaus DROP (Don't Route Or Peer) is a list maintained by the Spamhaus Project containing IP addresses and CIDR blocks used by known hackers, spammers, and malware. These lists are globally recognized and constantly updated. By integrating DROP, your site blocks entire IP ranges that have been verified as malicious by one of the most respected anti-spam organizations in the world.
Auto-Update Mechanism
The plugin syncs the lists every 60 minutes using an internal WordPress cron (wp_schedule_event). The process is transparent: no manual intervention is required. During each update, fresh data is downloaded from the SeenSecure API and Spamhaus, compared with the local database (table ssc_threat_intel), and changes are applied. If the site cannot reach the remote servers, the last downloaded list remains active until the next successful sync.
Tor Node Blocking
Tor (The Onion Router) is a network designed to anonymize internet traffic. While it has legitimate uses (privacy, journalism, censorship evasion), it is also used by malicious actors to hide their origin when attacking websites. Blocking Tor exit nodes significantly reduces the anonymous attack surface.
Why block Tor?
- Attackers use Tor to avoid geolocation and tracking
- Reduces brute force attacks, scraping, and vulnerability exploitation
- The exit node list is automatically updated
Considerations
- Legitimate Tor users will not be able to access your site
- Recommended for commercial sites, not for privacy or press sites
- You can disable this option if your audience includes Tor users
threat_intel.tor_nodes — Enable or disable Tor exit node blocking.
Configuration & Monitoring
Configuration Parameters
Status
Active / Inactive. Controls whether threat intelligence is operational. When inactive, no lists are downloaded and no IPs are blocked by this module.
Max Entries
Configurable range between 1,000 and 100,000. Recommended value: 50,000. A higher number consumes more database space but covers more threats. Adjust according to your server resources.
Update
Every 60 minutes automatically. You can also force a manual update from the panel. The last sync is displayed with a timestamp.
Status Monitoring
The Threat Intelligence panel displays the following indicators in real time:
Active/Inactive
Indicates whether the module is enabled. If inactive, no threat checks are performed.
Threat IPs
Number of malicious IPs currently in the threat list (SeenSecure API + Spamhaus).
Tor Nodes
Number of Tor exit nodes currently detected and blocked.
Last Update
Timestamp of the last successful sync with remote servers.
What to watch for
- Stale last update (> 2 hours without updating): Indicates a connectivity issue with the SeenSecure API or Spamhaus. Verify that your server can make external HTTP requests (
curl,file_get_contentswith allow_url_fopen).
- Threat IP count = 0: Possible error in the initial download or empty database table. Check WordPress logs and force a manual update.
- Tor node count = 0 with option enabled: The Tor node list may not have been downloaded yet. Wait for the next automatic sync or force a manual one.
PRO Limitations
Frequently Asked Questions
Are Threat Intelligence and the Protection Network the same list? No, they're two different sources that combine: Threat Intelligence brings already globally-known lists (SeenSecure API + Spamhaus DROP), while the Protection Network publishes IPs detected and corroborated in real time by other sites running SeenSecure.
Does blocking Tor also affect the other protections? No, it's independent: you can disable just the Tor exit-node blocking and keep the SeenSecure API and Spamhaus threat lists active with no issue.
What happens if my server can't reach the SeenSecure API or Spamhaus? The last successfully downloaded list stays active and protecting your site until the connection is restored at the next sync — you don't lose protection outright over a one-off network hiccup.
Do I need a PRO license for any protection of this kind? No: the free version already includes the SeenSecure API's basic lists (up to 1,000 IPs). PRO extends coverage with Spamhaus DROP, Tor blocking, and up to 100,000 entries.