Support

Go to Joomla's Global Configuration and set Behind Load Balancer to Yes. Did that help?

You need to check which IPs are getting blocked in the blocked requests log, and the site IP disallow list. Which one of these is your IP? Note that you may have both an IPv4 and an IPv6; you can check that in https://whatismyipaddress.com/ 

Are there any Blocked Request Log records with your IP address? What is the Reason and Target URL listed there?

What you tell me does not add up.

This message only appears when your IP address is blocked.

Your address may be blocked in two places: Site IP Disallow List, and Auto Blocked IP Addresses. If your IP address AND an IP block containing your IP address is in neither page then your IP is not blocked, therefore you cannot be receiving this message.

If your IP address was added automatically to the Site IP Disallow List it would happen because of several entries in the Auto IP Blocking History.

If your IP address was added automatically to the Auto Blocked IP Addresses it would happen because of several entries in the Blocked Request Log.

If the exact IP address is found in any (or a number) of these lists the Unblock IP feature will remove those records.

All of that information, and the fact that you should check those lists, are in https://www.akeeba.com/documentation/admin-tools-joomla/atwafissues.html.

So, I would say go through each list carefully, and check if either your IP address or a block of IP addresses containing it are in there and remove all of those entries from any and all of those lists they might be in.

If you find none of those records, something you are telling me is wrong. If your IP address is not blocked you can't be receiving the blocked message and, conversely, if you are receiving the blocked message then your IP address must be blocked. There is no possible way to receive the block message without your IP being blocked or vice versa.

The Web Application Firewall refers to all the various features in Admin Tools which block IPs, block requests, or send you emails when various events happen. Their configuration options can be found under the Configure WAF page.

What you have in mind seems to be the Secret Administrator URL Parameter feature in Admin Tools' WAF. If you have set one, let's say example, you need to access your site's administrator as https://www.example.com/administrator/index.php?example to see the login page. Since this sets a cookie in your browser until you manually log out you won't be able to test it easily unless you use Incognito / Private Browsing mode in your browser (since it runs with cookie isolation the cookie set in your browser's regular mode won't be used). Try once without the secret word, and you'll be kicked to the frontend or be shown an error, depending on your settings. Try again with the secret word and you'll see the backend login page.