IP blocking and rate limiting

Beyond brute-force protection, PowerSEC lets you block specific addresses or ranges, block countries, and limit how many requests one address can make.

Manual IP blocking

1. In WordPress, open PowerSEC → IP Blocking
2. Under Block IP address, enter an IPv4 or IPv6 address, or a CIDR range (e.g. 203.0.113.0/24)
3. Add a Reason (for your records)
4. Turn on Block permanently, or leave it off to use your default lockout duration
5. Click Block IP address

Blocked addresses are listed under Currently blocked IPs, each with an Unblock button. Blocks apply from the next request.

PowerSEC also blocks addresses automatically after repeated failed logins (see Login security).

Block lists

Under PowerSEC → Firewall → IP Blocklists (both off by default):

• Block TOR Exit Nodes — blocks known Tor exit nodes, refreshed daily
• Known Bad IPs — blocks a list of addresses you enter, one per line

Geo-blocking

1. Open PowerSEC → Firewall → Geo-Blocking
2. Turn on country-based blocking
3. Select the countries to block
4. Save

Rate limiting

Rate limiting is on by default. These are the default limits per address, per minute:

Change them under PowerSEC → Firewall → Rate Limiting. Setting XML-RPC to 0 effectively blocks xmlrpc.php.

Addresses that are never blocked

• Logged-in administrators are not blocked by the firewall
• PowerSEC Central's own addresses are never blocked, so sync and remote actions keep working
• If you are worried about locking yourself out, use PowerSEC → Advanced → Recovery mode to generate a recovery token or allowlist your current session

Reading the logs

PowerSEC → Firewall → WAF Block & Match Log shows Behavioral WAF matches. Blocks, lockouts and other security events are recorded in PowerSEC → Audit Log.

Behind a CDN

Behind a CDN, the visitor's real address arrives in an HTTP header. PowerSEC recognizes Cloudflare's network and reads its header automatically. For any other CDN or load balancer (such as AWS CloudFront), add its addresses under Trusted proxies (PowerSEC → Advanced); otherwise blocks would hit the CDN's address instead of the visitor's.