You can easily Auto-ban IP addresses which repeatedly attack your site.
When set to yes, the IP address of repeat offenders will be automatically banned based on the rest of the settings. This lets Admin Tools manage IP blocking automatically and is the recommended way to handle it. You MUST enable logging of security exceptions for this feature to work.
Admin Tools can optionally send you an email when an IP is automatically banned, to the email address entered in this field. This will allow you, for example, to determine if some IP is being regularly blocked, in which case it may be a good idea to place it in the permanent IP black list. Leave this field empty (default) to disable this feature.
For the correct country and continent to show up in your email, you must regularly update the GeoIP database as instructed in the Control Panel page.
The contents of the e-mails can be configured using the Email Templates feature in the Web Application Firewall page.
Chose how many attacks have to happen within how much time. For example, if you set it to 3 attacks in 1 hour, Admin Tools will ban a IP address from which at least 3 attacks have been blocked within the last hour.
How long the block will last. For example, setting it to 1 day will block all access from this IP address for a whole day.
If an IP triggers many auto-bans over a period of time it will be permanently banned (added to the IP blacklist) next time they are about to be auto-banned again. Make sure that you turn on the IP blacklisting in the Basic features tab by setting Disallow site access to IPs in Blacklist to Yes, otherwise the permanent blacklisting will have no effect.
If an IP triggers this many auto-bans it will be permanently banned (added to the IP blacklist) when they are about to be auto-banned again. Make sure that you turn on the IP blacklisting by setting "Disallow site access to IPs in Blacklist" to Yes, otherwise the permanent blacklisting will have no effect.
Allows you to show a specific message to blocked IP addresses. You may want to explain to the user that his IP was blocked because suspicious activity was detected as originating from his IP address.
You can use the special text
[IP] in all capital letters, without spaces between
the brackets and IP, to display the user's IP in the message. This may be useful if someone gets
accidentally blocked and asks you to help them.