Support

Ask them for their IP address at the time they receive this message. Look it up in Admin Tools, Web Application Firewall, Blocked Requests Log. What is the Target URL and Reason listed there? That's the only way you can possibly troubleshoot it. Otherwise, all you know is that something they did was very likely blocked by Admin Tools' WAF because of one of the features you have enabled but you have no idea what they did, or which feature it was blocked by.

If I were to blindly guess, I would say the most common cause is that they are entering the wrong username or password and you've enabled the option to treat failed logins as blocked requests. However, that's a wild guess. I really need the Target URL and Reason to be able to tell you if my guess is right.

1 & 2 are the same. The former is your login page menu item. The latter is where the login module form POSTs the login information to. Same issue, same fix. Go to Admin Tools, Web Application Firewall, Configure WAF, Hardening Options, set "Treat failed logins as a reason for blocking the request" to No.

3. They got blocked by trying to log in. They tried again and again, still got blocked. Then they tried going to the home page, but their IP address was now temporarily blocked from accessing any page of the site. Since this is a TEMPORARY IP block, it expires after a while. Therefore, they were able to access the site just fine.

I am saying that they were already blocked when they visited the home page.

Have you or have you not matched log entries to their IP addresses?

There is a reason I have been asking you to check the IPs and tell me if there are log entries and, if there are, what is the Target URL and Reason. This information dramatically changes the context of my response to you.

If you get no log entries for these IPs, my next step is to ask you if you see any log entries, and whether they all have the same IP, or an IP from a small set of 3–10 IPs. In the former case it's not Admin Tools, end of troubleshooting on my end. In the latter case I tell you to set Behind Load Balancer in Joomla which I cannot tell you to do if this is not the case as enabling it when it's not necessary creates a security issue (this option is only valid without causing a security issue – instead fixing one – when your site is behind a CDN, load balancer, reverse proxy, TLS terminator, or similar infrastructure).

If you do get log entries the Target URL and Reason will tell me why your users are getting blocked. There are too many decision branches going off from there to even write down.

When you told me in your previous reply that you see a Login Failure reason and gave me the two Target URLs I understood that you had done all of that, we are in the "log entries exist for these IPs, here's what they have to say" decision branch of this troubleshooting process and gave you an answer based on that. Since that's not the case, I am now starting this troubleshooting afresh, throwing away your previous response.