Firewall
Bans
Blocks a specific internet address, a whole range of addresses, or a kind of software from your entire site, for a set time or for good.
What it does
A banned visitor sees a short "Access Denied" page instead of your site, on every page, before WordPress does any real work.
You can ban one IP address, an IP range written like 203.0.113.0/24, or a user agent, the name a browser or robot gives itself, such as a known scraping tool.
Bans can last from 1 hour to 90 days, or be permanent. Other features add bans for you too, such as 404 detection.
Why it matters
When the activity log shows the same address attacking again and again, a ban stops it for good and saves your server the work.
Set it up
- Go to the Firewall tab, section Bans, and switch on Ban Users.
- Choose the ban type, type the address, range or user agent, add a reason you will understand later, and pick a duration.
- Click to add the ban. It appears in Active Bans, where you can filter and remove bans.
- Optionally edit the Ban Message that banned visitors see, then click Save Changes.
Good to know
Addresses on the IP allow list are never banned. Add your own office address there first.
Administrators are not blocked inside the admin area, but a ban does apply to them on the front of the site. Do not ban your own address.
User agents are easy for a robot to change, so a user agent ban stops lazy robots, not determined ones.
If your site is behind Cloudflare or another proxy, set up Real visitor IP first, or you may ban the proxy instead of the visitor.
Which plan includes it
IP and range bans are in every plan. User agent bans are part of Pro.
How it works, for developers
- Bans are stored in the
smg_banstable (type, value, reason, who added it, created, expires). Range and user agent lists are cached for 10 minutes in the transientsmg_ban_lists. - The check runs on
initat priority 1 and answers with HTTP 403 andwp_die(). Ranges must be IPv4 CIDR (/0 to /32); user agent bans match any part of the name, ignoring case. - Expired bans are deleted by the daily
smg_daily_cleanuptask. New bans fire thesmg_ban_addedaction, which the New Bans Added alert uses. - Settings:
smg_ban_users_enabled,smg_ban_message. Skipped whileSMG_SAFE_MODEis defined.
Quick answers about bans
What does Bans do in Stack Guard?
A banned visitor sees a short "Access Denied" page instead of your site, on every page, before WordPress does any real work. You can ban one IP address, an IP range written like 203.0.113.0/24, or a user agent, the name a browser or robot gives itself, such as a known scraping tool. Bans can last from 1 hour to 90 days, or be permanent. Other features add bans for you too, such as 404 detection.
Why use bans on a WordPress site?
When the activity log shows the same address attacking again and again, a ban stops it for good and saves your server the work.
How do I set up bans?
1. Go to the Firewall tab, section Bans, and switch on Ban Users. 2. Choose the ban type, type the address, range or user agent, add a reason you will understand later, and pick a duration. 3. Click to add the ban. It appears in Active Bans, where you can filter and remove bans. 4. Optionally edit the Ban Message that banned visitors see, then click Save Changes.
Which Stack Guard plan includes bans?
IP and range bans are in every plan. User agent bans are part of Pro.
More in Firewall
- IP allow listA list of trusted internet addresses, such as your office, that Stack Guard's blocking features never stop.
- Real visitor IP (trusted proxy)Tells Stack Guard how to find a visitor's real internet address when your site sits behind Cloudflare, a load balancer or another proxy.
- Country blockingBlocks visitors from the countries you choose, or allows only the countries you choose, using a country database stored on your own server.
- Custom firewall rulesYour own if-this-then-that rules for incoming requests: block, allow or just log requests that match a page address, a browser name, a visitor address and more.
Not running Stack Guard yet? It is free.
Download Free