{"id":189843,"date":"2020-07-23T20:48:05","date_gmt":"2020-07-23T20:48:05","guid":{"rendered":"https:\/\/premium.wpmudev.org\/blog\/?p=189843"},"modified":"2024-03-28T05:27:27","modified_gmt":"2024-03-28T05:27:27","slug":"defender-ip-address-lockout-firewall","status":"publish","type":"post","link":"https:\/\/wpmudev.com\/blog\/defender-ip-address-lockout-firewall\/","title":{"rendered":"How to Create a Powerful and Secure Customized Firewall with Defender"},"content":{"rendered":"

WPMU DEV\u2019s 5-star security plugin, Defender<\/a>, lets you easily set up a firewall, block IP addresses with custom blocklists and allowlists, and more…leaving unwelcome visitors unable to step even near your WordPress site.<\/p>\n

Hackers can be persistent at trying to get into your site and drop malicious code, figuring out your credentials, and leaving spam.\u00a0This tutorial will show you just how easy it is to set up Defender\u2019s IP banning and keep your WordPress site safe and protected.<\/p>\n

\"Defender
Ban IP addresses and lock out hackers from your WordPress site with Defender.<\/figcaption><\/figure>\n

Here are the areas we\u2019ll be covering (jump to a specific topic by clicking on it):<\/p>\n

    \n
  1. \n
      \n
    1. Automatically Identify Bad Acting IP Addresses<\/a><\/li>\n
    2. Creating a Custom Blocklist & Allowlist<\/a><\/li>\n
    3. Active Lockout Displays<\/a><\/li>\n
    4. Unlocking IP Addresses<\/a><\/li>\n
    5. Location Banning<\/a><\/li>\n
    6. Creating Custom Message for Banned Users<\/a><\/li>\n
    7. Importing and Exporting Custom Blocklist & Allowlist<\/a><\/li>\n
    8. Check Your Lockout Log for Suspicious Activity<\/a><\/li>\n
    9. Locked Yourself Out? Here’s How To Get Back In<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

      Most areas of this tutorial are accessible in Defender under the Firewall <\/strong>and IP Banning<\/strong> section unless specified differently.<\/p>\n

      Let\u2019s get started with the best and most powerful feature of Defender\u2019s firewall…<\/p>\n

      1. <\/a>Automatically Identify Bad Acting IP Addresses<\/h3>\n

      Defender automatically identifies bad acting IP addresses and adds them to a firewall, providing your site with ongoing security and protection.<\/p>\n

      You can lock out users who attempt a number of failed login attempts. Defender gives you control over the threshold and duration of the lockout in the Login Protection screen (Defender > Firewall > Login Protection<\/em>).<\/p>\n

      \n
      \n
      \"Defender
      Defender lets you set how many failed login attempts will trigger a lockout for a user’s IP address.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      You can view how many IP addresses have been temporarily blocked in the Active Lockouts section of the IP Banning screen (Defender > Firewall > IP Banning > Active Lockouts<\/em>). You can also unblock IP addresses here.<\/p>\n

      \n
      \n
      \"Defender
      View and release temporarily blocked IP addresses in the Active Lockouts section.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      You can also enable 404 detection (Defender > Firewall > 404 Detection<\/em>), and Defender will automatically block IP addresses that repeatedly request pages on your website that don’t exist. It will also temporarily block these offending IP addresses from accessing your site.<\/p>\n

      \n
      \n
      \"Defender
      Defender’s 404 detection blocks IP addresses that repeatedly request pages on your site that don’t exist.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      Tip:<\/em> You can use the 404 detection feature in combination with Defender’s login masking feature<\/a> to immediately identify and block IP addresses requesting your site’s login page.<\/p>\n

      In addition to Defender’s automatic IP blocking features, you can also block IPs manually, as the next section explains.<\/p>\n

      2. <\/a>Creating a Custom Blocklist & Allowlist<\/h3>\n

      Creating a custom blocklist & allowlist with Defender will keep unwanted IPs from accessing your site, including IP addresses for admins.<\/p>\n

      You can do this easily by entering IP addresses in the Defender > IP Banning > IP Addresses<\/em> section.<\/p>\n

      IPv4 and IPv6<\/a> are both supported for the blocklist and allowlist.<\/p>\n

      To ban IPs from accessing your site, select the first tab: Blocklist<\/strong>.<\/p>\n

      \n
      \n
      \"Defender
      Enter IP addresses you’d like to permanently ban from accessing your site in the Blocklisted IPs text area.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      Type in (or copy and paste) any IPs you want to block–one IP address per line. These IP addresses will no longer be able to access your site.<\/p>\n

      Select the next tab to add IP addresses that you want to always have access to your WordPress site to your Allowlist<\/strong>.<\/p>\n

      Note that Defender recommends adding your own IP to the Allowlist section to prevent being accidentally locked out of your site and even detects and presents your IP address for you.<\/p>\n

      \n
      \n
      \"Defender
      Defender recommends adding your own IP to the Allowlist section to prevent yourself from being accidentally locked out.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      After adding IP addresses to the blocklist and\/or allowlist, click the Save Changes<\/strong> button to update your settings.<\/p>\n

      3. <\/a>Active Lockout Displays<\/h3>\n

      The Active Lockouts section (Defender > IP Banning > Active Lockouts<\/em>) lets you easily view how many IP addresses are blocked from accessing your site based on the rules you have set.<\/p>\n

      \"Defender
      Defender lets you see how many IP addresses have been blocked.<\/figcaption><\/figure>\n

      And if you need to unblock any IPs, there\u2019s…<\/p>\n

      4. <\/a>Unlocking IP Addresses<\/h3>\n

      If you need to unblock a blocked or banned IP address for any reasons, just click the the Unlock IPS <\/strong>button in\u00a0the Active Lockouts<\/strong> section.<\/p>\n

      \"Defender
      Click the button to unlock blocked or banned IP addresses.<\/figcaption><\/figure>\n

      This will display all blocked IP addresses and allow you to unblock those you select by clicking the Unblock<\/strong>\u00a0icon.<\/p>\n

      \"Defender
      Unblock IP addresses by clicking on the padlock icon.<\/figcaption><\/figure>\n

      The IP will be automatically unblocked. There\u2019s no need to click any additional buttons or save anything further after this.<\/p>\n

      You can also search for specific IP addresses in the search area if you\u2019re having difficulty locating them on the list, and unblock all IPs with the click of a button.<\/p>\n

      \"Defender
      You can also search IP addresses and unblock all IPs with the click of a button.<\/figcaption><\/figure>\n

      5. <\/a>Location Banning<\/h3>\n

      In addition to blocking specific IP addresses, Defender also lets you ban entire countries from accessing your site.<\/p>\n

      This feature is handy when you don\u2019t want or expect traffic from specific locations, and want to stop hackers and bots visiting from certain countries.<\/p>\n

      All this can be done in the Locations<\/strong> section (Defender > IP Banning > Locations<\/em>).<\/p>\n

      Defender uses the GeoLite2 Database from MaxMind<\/a> for this feature. You will need to set up a free account to use location banning.<\/p>\n

      \n
      \n
      \"Defender
      Follow the steps to set up an account with MaxMind and ban countries you don’t want accessing your site.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      Follow the prompts and click on the links provided to set up your free account. You will receive an email with instructions on how to set up a password.<\/p>\n

      After logging in, click the link for a new license key in Defender\u2019s dashboard, create a new license key in MaxMind and copy and paste this key into the License Key<\/strong> field in Defender’s Locations section.<\/p>\n

      \"Where
      Where a new key is produced.<\/figcaption><\/figure>\n

      After pasting in your new license key, hit the Download<\/strong> button to enable the option to Blocklist <\/strong>and Allowlist<\/strong> any country.<\/p>\n

      Note: Allow a few minutes for the key to register.<\/p>\n

      Once the key has registered and feature has been activated, you’ll see a drop-down menu displaying a list of countries as you start typing.<\/p>\n

      Select the countries you want to blocklist from this dropdown menu and repeat this process for any countries you want to allowlist.<\/p>\n

      \"Defender
      Select the countries you\u2019d like to blocklist or allowlist from the dropdown menu.<\/figcaption><\/figure>\n

      Selected countries will appear in the box below the blocklist and allowlist areas. To remove any countries from your list, click on the \u2018X\u2019 next to the country\u2019s name.<\/p>\n

      \"Blocklist
      List of the countries added so far.<\/figcaption><\/figure>\n

      If you make any changes in this section, remember to update your settings by clicking the Save Changes<\/strong> button.<\/p>\n

      6. <\/a>Creating Custom Messages for Banned Users<\/h3>\n

      Defender lets you customize the message that will display to locked out users.<\/p>\n

      If you want to display a message other than the default that Defender automatically provides, just scroll down to the Message<\/strong> section (Defender > IP Banning > Message<\/em>) and enter your custom message in thetext area .<\/p>\n

      \"Defender
      Add a custom message to locked out users or use the default message provided.<\/figcaption><\/figure>\n

      Anyone on the blocklist will now be greeted with your message.<\/p>\n

      \n
      \n
      \"Defender
      Defender’s blocked IP message to unwelcome guests.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      7. <\/a>Importing and Exporting Blocklist & Allowlist<\/h3>\n

      If you want to export your blocklist and allowlist to use on another website or import a blocklist or allowlist from another website into your site, Defender makes this quick and easy using the Import<\/strong> and Export<\/strong> features found at the bottom of the IP Banning<\/em> screen.<\/p>\n

      \"Import
      Import and export your blocklist and allowlist for use across different sites.<\/figcaption><\/figure>\n

      Note that importing IP addresses from exported CSV files will not remove any existing IPs; these will simply be added to your existing lists. Also, export files include both your blocklist and allowlist.<\/p>\n

      8. <\/a>Check Your Lockout Log for Suspicious Activity<\/h3>\n

      In Defender\u2019s dashboard, head to Firewall <\/strong>> Logs<\/strong>. Here, you can view all of your lockouts and quickly ban, allowlist, or delete the list, plus easily export activity logs of IP lockouts.<\/p>\n

      \"Defender
      Defender logs all lockout activities.<\/figcaption><\/figure>\n

      You can find logs using a range of sorting and filtering functions, adjust the date range, and export these as a CSV file.<\/p>\n

      \n
      \n
      \"Defender
      Use the sorting and filtering features to find logged records quickly and easily.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

      You can also expedite things using the Bulk Actions<\/strong> feature in Firewall > Logs. Select all items at once or check individual boxes, then use the options in the dropdown menu and click the Apply button to ban, allowlist, or delete IP addresses.<\/p>\n

      \"Defender
      Perform bulk IP address banning, allowlisting, or deletions using the Bulk Actions feature.<\/figcaption><\/figure>\n

      To get more detailed information about the logged event, click on the dropdown arrow next to an item. You\u2019ll also have the option to allowlist or ban the IP in this section.<\/p>\n

      \"Defender
      See detailed descriptions of logged events and ban the IP address or add it to your allowlist.<\/figcaption><\/figure>\n

      And just like that, all of your lockouts are now taken care of.<\/p>\n

      Locked Yourself Out? Here’s How To Get Back In<\/h2>\n

      Defender offers so many options to lock out unwanted visitors…but, what if you accidentally lock yourself out due to multiple failed login attempts?<\/p>\n

      If you are the administrator of the site and you’ve locked yourself out, there’s an easy and secure way to get back in.<\/p>\n

      If you have exceeded the number of valid login attempts (set in Defender’s Firewall > Threshold<\/a> settings), you will see a screen like the one shown below.<\/p>\n

      Click on the Unlock Me<\/strong> button.<\/p>\n

      \"Defender
      Accidentally locked yourself out? Defender’s Unlock Me feature lets you get back in!<\/figcaption><\/figure>\n

      Enter the username or the email address associated with the site’s login and click the Unlock Me<\/strong> button again. An email will be sent to your email address with a link to unlock yourself.<\/p>\n

      \"Defender's
      Enter your admin username or email and click the button to regain access.<\/figcaption><\/figure>\n

      <\/a>Setting Up a Lockout Firewall Can\u2019t Get Any Easier<\/h2>\n

      Unwanted guests won\u2019t get far with Defender\u2019s custom IP address lockout.<\/p>\n

      And, as you can see, it\u2019s more than just an IP address lockout feature — you can create custom messages, set location banning, view and edit logs, and so much more.<\/p>\n

      For more tips on using Defender, check out our articles about finding & deleting suspicious code<\/a> and how to stop hackers in their tracks<\/a>.<\/p>\n

      For more information about using all the security features of the plugin, check out Defender’s documentation page<\/a>.<\/p>\n

      [Editor\u2019s note: This post was originally published in July 2023 and updated in March 2024 for accuracy.]<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

      WPMU DEV\u2019s 5-star security plugin, Defender, lets you easily set up a firewall, block IP addresses with custom blocklists and allowlists, and more…leaving unwelcome visitors unable to step even near your WordPress site. Hackers can be persistent at trying to get into your site and drop malicious code, figuring out your credentials, and leaving spam.\u00a0This […]<\/p>\n","protected":false},"author":811449,"featured_media":221667,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"blog_reading_time":"9","wds_primary_category":11259,"wds_primary_tutorials_categories":0,"footnotes":""},"categories":[263,11260,11259],"tags":[],"tutorials_categories":[11231],"class_list":["post-189843","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","category-wpmu-dev-products","category-wpmudev-tutorials","tutorials_categories-defender-pro"],"_links":{"self":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/189843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/users\/811449"}],"replies":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/comments?post=189843"}],"version-history":[{"count":42,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/189843\/revisions"}],"predecessor-version":[{"id":221633,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/189843\/revisions\/221633"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media\/221667"}],"wp:attachment":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media?parent=189843"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/categories?post=189843"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tags?post=189843"},{"taxonomy":"tutorials_categories","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tutorials_categories?post=189843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}