Is there a time period delay before a firewall rule blocks an IP?

I have a WP site at northmooracreshoa.org. The site is hosted on Siteground shared hosting. One particular IP is pounding it every couple of minutes. When I got on this morning there were 3000 attempts from the last few days.
The IP is 146.66.66.122

I have banned it in wordpress security (SecureScanPro), and created a WAF block in cloudflare - but this ip is still trying to get in when I view the logs in WP.

Do I need to add it to htacess?

Thank you for your time.

This IP belongs to Siteground itself. It’s probably a service that runs frequently, such as a cronjob.

You should contact Siteground support and inquire about it, because in case this IP is from another website hosted by them (potentially a hacked site), they would be able to suspend the site and prevent this.

In case it is, as I suspect, one of their services, ask them if they can make it run directly at the server instead of over the internet.

1 Like

Thank you, @cbrandt !

I did contact Siteground and they said it was some plugin I was running and that I should not be blocking that IP.

So I unblocked the IP.
And I was checking out the plugins and thought to remove the “classic editor” plugin, as it was not being used (as Divi has it built-in to the theme these days).

I checked the log, and the login attempts have stopped.
That seems a little bizarre to me, but I am relieved that it has stopped.

Thank you for your help!

1 Like

@sandro

I got a message from you in my email - but I do not see it here.
The answer is - yes, I did remove the block from WAF on Cloudflare.

I am puzzled that when I try to reply to your support emails from my Outlook email - they bounce back to me saying
"We’re sorry, but your email message to [“[email protected]”] (titled RE: [Cloudflare Community] [Security] Is there a time period delay before a firewall rule blocks an IP?) didn’t work.

None of the destination email addresses are recognized, or the Message-ID header in the email has been modified. Please make sure that you are sending to the correct email address provided by staff."

I can of course reply, by coming into the forum, which I am happy to do.

Thanks!

This topic was automatically closed after 30 days. New replies are no longer allowed.