This article is written as questions and answers.
Where can we see more detailed information on how the premium plans work? For example, “Access Active Cloud Blocklist”, what specifically is this feature for?
We calculate various stats for all IPs across all premium accounts and track the most frequently denied ones. This is the “Active Cloud Blocklist”. If this feature is active, all attempts to log into a site will be verified against that IP dataset.
The auto add to blocklist, can this be disabled?
Yes.
How does the cloud upgrade function as the intermediary to thwart server loads from excessive login attempts?
Each time a login attempt happens, a WordPress site searches inside its own internal database for information about active lockouts and lockout rules. The database tables that store lockouts and logs can quickly grow to a very large size if there are a lot of attacks. Since thousands of attacks happen every day, this puts a large load on the database and slows the size down. With the cloud app installed, all those checks happen in the cloud, logs, lockout rules and lockouts are stored in the cloud as well. This outsources the load from the local database to the cloud almost completely.
We have been using your free plugin for some time now and it is excellent! The issues we have right now is that the US based dynamic IPs are hitting our site with login attempts that appear to be a “Dark Web” list of password/email combinations. So we don’t really have attempts to log in to admin but attempts to log in to our customers’ accounts. The attacks, initially slow down our site by overloading the server (and yes, we have a lot of resources available through our hosting). The attacks are eventually slowed by the plugin locking out IPs. However due to the type of attack using many IPs and many email/password combinations we still have about a 24-36 hour window of time that our server gets overloaded. We need a cleaner solution that will not effect our customers in any way. We also have CloudFlare enterprise on the site with a “High” firewall setting on the /my-account page, however obviously that is still not enough to block these attempts. How can your premium upgrade help us? How can I find more detailed information on how it works?
The load on the database will be outsourced to our cloud which is built on top of Amazon infrastructure.
We’re planning to create a more advanced load cutting feature by using an intermediate verification page connected to the cloud. This should be coming out in the next few months. This article outlines our upcoming improvement and projects.