Cusom rules not firing correctly

Website, Application, Performance Security
1

What is the name of the domain?

What is the issue you’re encountering

Rule= Country >does not equal>united states>block set to fire first. getting ips from other countries through

What steps have you taken to resolve the issue?

wordfence, tried rate limiting through cloudflare and i am now in under attack mode, which seems to be working for now, this person/bot has been hitting me the last few days with failed card attempts

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full

What are the steps to reproduce the issue?

out of country IP site loads or at least people are getting around it

2

May I ask you to describe what you’re trying to achieve?

You want to allow only requests from USA and block all the others? :thinking:

slika
slika1100×871 25.4 KB

Make sure to set CF-Connecting-IP in the Settings page:

slika
slika938×225 30.4 KB

3

thanks for the response! That is correct we only want to have users from USA as it seems most of our issues come from outside of the US.We would love to be able to allow external traffic but havent been able to stop these attacks. The CF-connecting-IP forces cloudflare use?

4

What we are seeing right now are attempts to use a card on our checkout (1300 attempts in the last 48 hrs cvv declines for the most part) ideally the rate limiting rule we set URL path>Wildcard>/checkout/* 6 requests> 1 minute>managed challenge>first

but it didn’t do anything, the bot/person just continued on like nothing was there. we turned on under attack mode which seems to have stopped the bleed for now.

5

Does it come from the same IP address or it’s rotating IP addresses? :thinking:

At Cloudflare dashboard under the Security → Events, or rather in Wordfence? :thinking:

While keeping it, you might have to track & trace the requests from the Security → Analytics and Security → Events to create a Custom WAF Rules accordingly to block this kind of type of attack so you can disable “I am under an attack” mode and keep blocking it while your Websites keeps functioning normally for your Website visitors and customers.

6

Rotating IPS once i block in wordfence it switches name address card info and IP

I am not even getting failed notifications in woo for most of it, 2 today out of a few hundred maybe even thousand attempts it doesnt seem to be going through cloudflare at al. I did just change that WF setting to get IP from cloudflare

7

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.