The IP Firewall in Practice
On this page
A public site is probed all day: WordPress login attempts against a site that has no WordPress, path-traversal strings, scanners walking a list of plugin paths. Inkwell's IP firewall scores those requests, blocks an address that crosses a threshold, and shows you what it did under Desk, Security.
How it scores
Each request to a known exploit path, each repeated 404, each failed sign-in adds points to the address within a sliding window. Cross the threshold and the address is blocked for a set number of hours; a repeat offender can be escalated. The threshold, window and block length are settings.
What it never does
- It never breaks a request: if the database is unreachable, nothing is blocked and the site keeps serving.
- It never blocks loopback, private ranges or the allowlist you configure.
- It never scores a verified search or AI crawler for 404s, because losing Googlebot costs more than any probe.
- It never scores a signed-in staff member.
- It never trusts a forwarded-for header unless you say the site is behind a proxy you control.
Operating it
Security lists blocked and allowlisted addresses with the reason and the expiry. Block or unblock by hand, allowlist an office range, and read the Error Monitor beside it for the 404 signatures that fed the score. On this demo the block length is six hours, so an over-enthusiastic visitor is not locked out for a day. Pair it with two-factor and the audit trail for the account side.
