Traffic Log | SeenSecure Help

Traffic Log Overview

⭐ PRO-only feature: the full Traffic Log is a PRO feature ("Advanced Traffic Logs"). On the FREE plan this tab is marked with a PRO label and its content is shown behind an upgrade overlay; on top of that, traffic logging itself is turned off (nothing is lost retroactively — new requests simply stop being recorded while the plan is FREE). If you see this screen working normally, your PRO license is active.

SeenSecure's Traffic Log records every HTTP request that reaches your website, including both allowed requests and those blocked by the firewall. Unlike systems that only log incidents, this complete record gives you full traffic visibility to detect patterns, identify threats, and fine-tune your security configuration.

Why it matters: Without a complete log you cannot distinguish between a legitimate traffic spike and a DDoS attack, nor know if your block rules are working correctly. The Traffic Log is your single source of truth for every security decision.

Log columns

Column	Description
Date / Time	Exact timestamp of the request. Uses the timezone configured in WordPress.
Country	Country of origin of the IP with flag and ISO code. Helps identify traffic from unusual regions.
IP	Client IP address. Displayed in full to facilitate block or whitelist decisions.
Type	General category of the event recorded in that row.
Device	Icon of the device the request came from (mobile, desktop, bot, etc.).
Risk	Estimated risk level of the request (e.g. Low, Medium or No risk), computed by the firewall's internal engine.
WAF Mode	Firewall mode (Monitoring, Protection, Strict...) that was active at the time of that request.
Action	What SeenSecure did with the request: allowed, monitored (logged without blocking), or blocked.
Protection	Module that handled the request: Rate Limiting, Geo Blocking, Bot Protection, Anti-Injection, Upload Protection, HTTP/1.0, XML-RPC, Backup, or "Normal traffic" if no protection intervened.
Summary	Human-readable description of the event. Explains why the request was blocked or allowed.
URI	Requested path. Shows the full path to identify which pages or files are being attacked.

💡 Real column names: in the admin table the headers appear in uppercase, in this exact order: FECHA/HORA, PAÍS, TIPO, IP, DISP., RIESGO, MODO WAF, ACCIÓN, PROTECCIÓN, RESUMEN, URI — the plugin's admin UI is not translated into English.

Summary cards

At the top of the Traffic Log you will see cards with live statistics that give you a snapshot of your site's current status:

Total requests

Total number of requests in the selected period.

Blocked

Requests blocked by the firewall. A high number may indicate an ongoing attack.

Allowed

Legitimate requests that passed through the firewall without incident.

Unique IPs

Number of distinct IP addresses that have made requests to the site.

Note: Summary cards are updated in real time. Use them to quickly spot anomalies without reviewing every single log entry.

Filtering & Search

The Traffic Log offers multiple filtering options to help you find exactly what you are looking for, even with thousands of records.

Free text search

The main search field lets you search across IP, URI, and country simultaneously. Type any term and the log will filter in real time showing only matches.

"Protection Type" filter

The Protection Type dropdown is populated dynamically with the modules that have actually generated records on your site. The most common options are:

Rate Limiting

Requests blocked for exceeding the requests-per-minute limit.

Geo Blocking

Requests from a country blocked by the Geo Blocking rule.

Bot Protection

Traffic identified as a bot by User-Agent or fingerprinting.

Anti-Injection

SQL injection, XSS, or other attack pattern attempts.

Upload Protection

File uploads blocked by upload protection.

HTTP/1.0 (403)

Requests using the HTTP/1.0 protocol, commonly used by automated tools.

Normal traffic

Legitimate requests that did not trigger any protection.

Categories like XML-RPC or Backup may also appear if those modules have generated records on your install.

"Status" filter

The Status dropdown filters by the final action applied to the request:

Allowed (monitor/OK): the request passed without restrictions.

Blocked (403): the request was stopped with an HTTP 403.

Denied, CAPTCHA Challenge, Monitor and Log only: other possible actions depending on which protection intervened and the firewall mode active at the time.

ℹ️ There is no "Method" filter: the Traffic Log does not have a dropdown to filter by GET/POST. You can locate specific requests by combining free-text search (IP, URI, country) with the Protection Type, Status, and date-range filters.

Date range filter

The From and To date pickers let you narrow the analysis to a specific period. For example, to investigate a spike that occurred during early morning hours, or to compare traffic before and after enabling a new security rule.

Pagination

Results are displayed in pages of 50 records. Use the pagination controls at the bottom to navigate between pages. Combined with filters, you can quickly review large volumes of data.

Search tip: To identify attacks, filter by Status = Blocked (403) and group by IP. If you see many blocked requests from the same IP within seconds, it is an automated attack.

Actions & Context Menu

Right-click on any Traffic Log entry to open the context menu with quick actions. These actions let you respond to security events without navigating to other screens.

┌─────────────────────────────────────────┐ │ 🔍 Ver Detalles │ │ 🧩 Ir a la protección │ │ 🚫 Bloquear IP │ │ ⛔ Agregar a Blacklist │ │ ✅ Agregar a Whitelist │ │ 📋 Copiar IP │ │ 🌐 Ver WHOIS │ │ 💾 Exportar Entrada │ └─────────────────────────────────────────┘

(The context menu is not translated into English yet — item labels appear in Spanish as shown above. The list below explains what each one does.)

Menu options

🔍 View Details

Opens a window with full request information: complete headers, User-Agent, query string, cookies, and the exact rule that caused the block.

🧩 Go to protection

Takes you straight to the settings tab of the module that handled that request (e.g. Rate Limiting or Geo Blocking), so you can adjust the rule without searching for it manually.

🚫 Block IP

Opens a form where you choose the block duration (1 hour, 6 hours, 24 hours, 7 days, 30 days, or permanent) and optionally enter a reason. It is not a fixed 2-hour block: you choose the length.

⛔ Add to Blacklist

Adds the IP to the permanent blacklist. The IP will be blocked indefinitely until you manually remove it from IP Management.

✅ Add to Whitelist

Excludes the IP from all firewall blocks. Use this option when you identify a false positive (a legitimate visitor incorrectly blocked).

📋 Copy IP

Copies the IP address to the clipboard. Useful for investigating the IP in external tools or sharing it with your team.

🌐 View WHOIS

Opens a WHOIS lookup in a popup window to get information about the IP owner, their ISP, and geographic location.

💾 Export Entry

Exports only that single row (not the whole visible log) and lets you pick the format: JSON, CSV, or XML. To export the full log with date and protection filters, use the Export CSV button at the top of the page (PRO feature).

Identifying attack patterns

Using filters and the context menu you can quickly detect these situations:

Brute force attack: search for wp-login.php in the search field and filter by Status = Blocked (403). If you see many different IPs trying credentials, enable Rate Limiting or login CAPTCHA.

Vulnerability scanning: look for repeated requests from the same IP in the URI column to paths like /wp-content/plugins/... or /xmlrpc.php — the typical signature of an automated scan.

DDoS attack: filter by Protection Type = Rate Limiting. A sudden increase of different IPs being rate-limited indicates a distributed attack.

Caution: Before adding an IP to the permanent blacklist, verify it is not a false positive by using View Details to see the full headers. A legitimate crawler (Googlebot, Bingbot) may look suspicious but should not be permanently blocked.

Troubleshooting

Common issues

Log is empty or shows no recent data
Causes: Write permission issues, insufficient disk space, or traffic logging is disabled in firewall settings.
Solution: Verify that wp-content/uploads/ssc-traffic-logs/ has write permissions. Check that "Traffic Logging" is enabled in firewall settings. Review available disk space.

Too many blocked records, looks like a massive false positive
Causes: An overly restrictive security rule, a recent configuration change, or an external service (CDN, monitor) that changed its source IP.
Solution: Temporarily switch to Monitor Mode in firewall settings to stop blocking while you investigate. Review the last 24h logs to identify the problematic rule. Add the necessary IP or range to the whitelist.

Traffic Log page loads very slowly
Causes: The log table has millions of unrotated records. Data volume slows down queries.
Solution: Use the Empty Log button to delete old records. Configure automatic rotation so logs are cleaned every 30 or 60 days. Use date range filters to limit results before the page loads.

The "Empty Log" button
The Empty Log button at the top of the Traffic Log deletes all records from the table. This is useful when the data volume is very large and you want to start fresh, or after resolving a mass incident to keep only relevant data going forward. Deleted records cannot be recovered.

PRO features

PRO

The following features are available in the PRO version of SeenSecure:

PRO Advanced export

Export logs with saved filters, automated report scheduling, and additional formats (PDF, JSON) beyond CSV.

PRO Real-time alerts

Receive notifications via email, Slack, or webhook when specific attack patterns are detected in the traffic.

PRO Extended retention

The FREE plan barely retains any historical traffic (a window of just a couple of days). PRO extends the Traffic Log retention window to 90 days, with fast search across the entire period.

PRO Geographic analysis

Interactive heat map showing the geographic origin of all requests, ideal for identifying regional attacks.

Need more help? If you have specific questions about your Traffic Log configuration, check the General Firewall section or the IP Management documentation to understand how they relate to the traffic log.