New to the community? Start here

[Defender Pro] Defender STILL over-active in blocking IPs

Hi there,
I’ve submitted two related tickets about this, and it seems this is coming up again. For the last couple of weeks, we’ve been getting intermittent reports from clients on different domains that either they, themselves, or a public reader/user (without a login) is getting the message:

The administrator has blocked your IP from accessing this website.

We’ve run through ideas that maybe it’s Hummingbird, but we’ve still never full been able to resolve this. I’m also not sure what makes Defender decide to block an IP, other than 404s and login attempts, but we’ve got 404 detection disabled to try and keep these IP lockouts down. Disabling Hummingbird does NOT fix the problem, but clearing the IP ban list sometimes does. Truly, the only thing that helps each time is deactivating and resetting Defender, which is not a permanent solution.

I’m really at a loss now. Some clients are getting angry that their readers are being blocked from viewing their sites, and other clients are angry that they can’t log in — if you guys have an idea, I really really could use some support. If not, I’m going to have to abandon Defender, because this issue has been ongoing for more than a year and we can’t deal with it anymore.

Support access for this site is enabled, but as I said, this is happening across our network now.

Mon, 23 Mar 2020 19:24:21
More Defender Pro discussions
Defender Pro
  • roundhouseguys
    • The Incredible Code Injector

    UPDATE: Another site of ours is reporting the same issue, and reported that after switching networks (wifi to mobile data) they were able to access the site, which suggests that IPs are being incorrectly blocked and/or blacklisted. I’m not sure what else to do, but to deactivate Defender entirely across our whole network, since we can’t be sure that it’s not blocking out our visitors!

    On visiting the other site, I was also blocked, though I didn’t whitelist my own IP so I could see this error occur myself. I visited the site earlier today with no issue.

    This has become urgent — please advise, thank you for your help.

  • Kasia Swiderska
    • Support nomad

    Hello roundhouseguys ,

    I’m sorry about this ongoing issue.

    So just to summarize the issue now: visitors (no logged-in users) and users of the sites (logged in) and blocked from access to the site, despite that their IP is not on the Blacklisted IPs list?
    And they only see message ” The administrator has blocked your IP from accessing this website.” without previous failed login attempts?
    With caching or no changing in Hummingbird, this is always happening?

    Can you temporarily disable the feature ” Login Protection” and then monitor if users are still getting banned or not?
    I checked logs and it only shows that only some login attempts are banned (mostly for the Banned usernames) but I would like to establish if this feature is faulty on your site or there is something else in Defender causing this.

    Let me know when it is done and if there was any difference.

    kind regards,
    Kasia

  • roundhouseguys
    • The Incredible Code Injector

    Hey Kasia,

    Thanks for your help. You have it mostly right — it used to see that this was a Hummingbird issue, but that is no longer the case. With caching or not, this issue occurs. You are correct, they see the “blocked” message with no previous failed login attempts. I have been getting this complaint mostly from clients directly, who are site admins on their respective, isolated sites.

    I am afraid to turn Defender back on at all, and risk angering my client if they’re blocked out again, or their users start reporting it again. I am not willing to let my live sites be potentially blocked due to this bug — is there a way we can troubleshoot this another way?

  • Kasia Swiderska
    • Support nomad

    Hello roundhouseguys ,

    It’s not possible to investigate that issue without testing it on a site where it happens, but I understand your concerns about activating it again on live site. In this case, it would be helpful if there would be a staging site of one of the sites affected with that problem, preferably on the same server.
    Can you check if you can create staging of one of the sites so we can troubleshoot that further?

    kind regards,
    Kasia

  • Patrick Freitas
    • FLS

    Hi roundhouseguys

    Thank you for the staging.

    Would be possible clone the media library too, once the images don’t exist it would trigger some 404 and 403 making multiple lockouts and we need to avoid those false positives lockouts and try to replicate the closer as possible of live site.

    Also, would be great if you could send us some information for the staging website.

    Note: Don’t leave your login details in this ticket.

    Instead, you can send us your details using our contact form https://wpmudev.com/contact/#i-have-a-different-question:

    Subject: “Attn: Patrick Freitas”

    – Site login URL:

    – WordPress admin username:
    – WordPress admin password:

    – FTP/SFTP credentials

    Host:
    Username:
    Password:
    Port:

    – cPanel credentials

    Host:
    Username:
    Password:

    – Folder path to the site in question:

    – Link back to this thread for reference

    – Any other relevant URLs/info:

    Please, reply to the ticket once you have sent the information.
    Best Regards
    Patrick Freitas

  • roundhouseguys
    • The Incredible Code Injector

    Hey again,

    I just migrated the staging site (complete, this time, with media library, etc) onto a fresh staging environment. BUT I just tried sending you credentials, as requested above, and I can’t pass the CAPTCHA!! No matter what I do, I get an “image captcha validation failed” message! Please let me know when I can proceed…

    Thanks!

  • Patrick Freitas
    • FLS

    Hi roundhouseguys

    Thank you for the credentials.

    I checked this problem by following those steps:

    – I forced myself a lockout from Defender
    – Refreshed the page a couple of times to make sure I got the lockout page
    – Using a VPN I removed that IP from the lockout on Defender Settings
    – Checked the normal browser and kept getting the lockout page.
    – Checked the incognito mode and same issue.
    – Using the browser console > Network > Disable cache and refreshed the page

    [attachments are only viewable by logged-in members]

    And then the website loaded correctly.

    It is a browser cache that is making the lockout page to show even the Hummingbird cache is disabled.

    Could you try to replicate the taken steps?

    I see the website is connected to Cloudflare, could you navigate to Cloudflare > Enable the development mode and see try to replicate the problem again on the staging website but without Cloudflare enabled.

    Let us know the result you got.
    Best Regards
    Patrick Freitas

  • roundhouseguys
    • The Incredible Code Injector

    Hey Patrick,

    I repeated your steps and got the same result, though it was slightly different every time. Once, the browser wasn’t “tricked,” and allowed me to access the site again, but the other times it worked as you described.

    When I set the domain to bypass CloudFlare, I still had the issue, although the message changed to

    You have been locked out due to too many invalid login attempts.

    . Disabling Cache in the console didn’t help, either.

    One thing to note, the following rule is in all of our wp-config.php files because our sites are hosted behind reverse proxies:

    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
        $_SERVER['HTTPS'] = 'on';
}

    Thanks for your help, Patrick.

  • Patrick Freitas
    • FLS

    Hi roundhouseguys

    Thank you for the update.

    When I set the domain to bypass CloudFlare, I still had the issue, although the message changed to

    We could notice too, after unblocking the IP and refresh the page the message changed.

    Just to make sure we are on the same page.

    When you disable the browser cache using the console browser it allowed you to get in on all tests?

    Best Regards
    Patrick Freitas

  • roundhouseguys
    • The Incredible Code Injector

    Hey Patrick,

    No, disabling the browser cache did not help — it only made the message change from the first ‘The administrator has blocked your IP from accessing this website’ message, to now showing the ‘You have been locked out due to too many invalid login attempts’ message.

    Thanks,
    Nick

  • Patrick Freitas
    • FLS

    Hi roundhouseguys

    Thank you for confirming the information.

    I made some more tests on my lab site and I was able to replicate the issue.

    When we navigate to IP Lockout and unlock the IP it keeps getting the Defender page and just changes the warning.

    Only when we add it to whitelist it will unblock the page correctly.

    The only issue that I couldn’t replicate was this:

    UPDATE: Another site of ours is reporting the same issue, and reported that after switching networks (wifi to mobile data) they were able to access the site, which suggests that IPs are being incorrectly blocked and/or blacklisted. I’m not sure what else to do, but to deactivate Defender entirely across our whole network, since we can’t be sure that it’s not blocking out our visitors!

    As soon I switched to the VPN or WiFi the page got unlocked.

    This sounds a different problem, as this is a different website, could you create a staging website and a new support ticket and we can closer investigate this too?

    On a different topic, we can get this well organized.

    Best Regards
    Patrick Freitas

  • roundhouseguys
    • The Incredible Code Injector

    Hey Patrick,

    I think you’re misunderstanding — the ‘UPDATE’ portion is basically saying the same thing, about switching networks. When they switched from WiFi to mobile (or, in your/my case, when we test going back and forth from VPN/no-VPN), they’re allowed back onto the site. In other words, this text is describing the same issue. The problem is the same: from a different IP, the site loads fine. The problem is, why are they getting blocked in the first place? Again, many of the users having the problem are NOT trying to log in, they’re just visitors! So our tests of purposefully getting locked out via login attempts is all well and good, but that’s not what’s happening to many users.

    Thanks,
    Nick

  • Patrick Freitas
    • FLS

    Hi roundhouseguys

    Thank you for update and sorry for the misunderstanding.

    For the staging site that was provided, I can see most of the logs are for wrong username.

    [attachments are only viewable by logged-in members]

    I can see there are some USA IPs, I’m wondering if Cloudflare is caching the error page causing the problem for visitors.

    You can decrease the number of lockouts by masking the wp-admin page on Defender > Advanced Tools > Mask URL.

    Working on support, I see sometimes the theme has the retina script but the 2x images are not uploaded to the media library, so, when the retina user try to access the website it will throw on multiple 404 files blocking the user.

    In case you are having this problem on a different website too, could you please, grant the support access and we can take a look on Defender Logs?

    Best Regards
    Patrick Freitas

  • roundhouseguys
    • The Incredible Code Injector

    Hey Patrick Freitas ,

    Is there a way to signal CloudFlare to not cache Hummingbird error pages? I think you’re on to something there — the inconsistent nature of the issue confirms that, I believe. I’m wondering if I can create a Page Rule, or maybe even there’s a way on the site itself to signal to CloudFlare that a particular page should not be cached. Or maybe a way to override the Expires and Cache-Control headers? Or maybe I’m off base?

    We will try masking the login area, and see if that helps. Where are you seeing the retina script appearing? I’ll have to check that out.

    Unfortunately, I don’t have time today to spin up another staging site, but I can do in the coming days if we still need it.

  • Patrick Freitas
    • FLS

    Hi roundhouseguys

    I checked and I can see the Defender applies:

    <meta http-equiv="Cache-control" content="max-age=0">

    It should avoid the cache, but I also found this link that can help.
    https://community.cloudflare.com/t/403-caching/13313

    I hadn’t tested the Cloudflare workers yet, but in case you find a different solution, feel free to share with us.

    We will try masking the login area, and see if that helps. Where are you seeing the retina script appearing? I’ll have to check that out.

    I didn’t see the retina script, just sent this information about one of the similar cases that I already had the past.

    Let us know if you need any further help on this.
    Best Regards
    Patrick Freitas