Hi Igor, thanks a lot!
From my perspective, IP blocklists don’t help much:
- Attackers keep changing their IPs constantly (botnets, proxies, cloud, Tor) – so a list is often outdated before it even kicks in.
- Big lists like AbuseIPDB would have to be checked on every page load. That slows down the site with barely any real security benefit.
That’s why HTProtect blocks based on what a request actually does – i.e. attack and exploit patterns – regardless of IP. The attack itself gets stopped no matter where it comes from.
You could consider adding a small manual blocklist for a few really persistent troublemakers as a supplement. But as the main defense, IP blocking isn’t very effective.
You can easily add such IP blocks in HTProtect via custom rules in the “at the beginning” field of the .htaccess. I’ve done that myself for some very persistent bot traffic that was hammering a site.
Cheers
Pascal