> ## Documentation Index
> Fetch the complete documentation index at: https://docs.recon44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IP Blocking: Automatic and Manual Controls

> Recon44 blocks malicious IPs at the edge on exploit detection — traffic never reaches your origin. Block, whitelist, or geo-block any IP in one click.

When Recon44 identifies a malicious request, it stops it at the edge — the blocked traffic never reaches your origin server. IP blocking works in two ways: automatically, when the WAF detects an exploit pattern, and manually, when you choose to block or whitelist a specific IP directly from the dashboard.

## How automatic IP blocking works

Automatic blocking fires the moment a request matches a WAF rule in active blocking mode. The sequence is:

<Steps>
  <Step title="Request arrives at the edge">
    Recon44 intercepts the request at the edge node closest to the visitor. Your origin server has not received anything yet.
  </Step>

  <Step title="WAF evaluates the request">
    The full request — URL, headers, body, cookies — is evaluated against 200+ OWASP Core Rule Set patterns in under 50ms.
  </Step>

  <Step title="Exploit pattern matches">
    If a rule fires (e.g., `WAF-SQLI-01` for a SQL injection attempt), the request is immediately dropped. The source IP is added to the active blocklist.
  </Step>

  <Step title="Subsequent requests from the IP are blocked at the network level">
    Once an IP is on the blocklist, future requests from that address are dropped before WAF inspection even runs — reducing overhead and ensuring the attacker receives no further responses.
  </Step>

  <Step title="Event appears in your Threat Feed">
    The block is logged in your Live Threat Feed with the source IP, country, attack type, rule ID, and the `blocked` action. You can review it, whitelist the IP if it was a false positive, or leave it blocked.
  </Step>
</Steps>

<Note>
  Automatic IP blocking requires **Pro plan or above**. On the Free plan, the WAF runs in read-only mode — exploit patterns are logged but not blocked. Manual IP blocking from the dashboard is available on all plans.
</Note>

## Manual block and whitelist

You can block or whitelist any IP from the dashboard without waiting for an automatic trigger.

<Tabs>
  <Tab title="Block an IP">
    <Steps>
      <Step title="Find the IP in your Threat Feed">
        Open **Threat Feed** from the left navigation. Locate the entry for the IP you want to block — you can filter by source IP using the search bar.
      </Step>

      <Step title="Click Block IP">
        Expand the entry and click **Block IP**. The IP is added to your blocklist immediately. All future requests from that address are dropped at the edge.
      </Step>

      <Step title="Confirm in your Block List">
        Navigate to **Security → Block List** to see all manually blocked IPs, when they were added, and who added them.
      </Step>
    </Steps>

    You can also add an IP directly from **Security → Block List → Add IP** without needing a corresponding Threat Feed entry.
  </Tab>

  <Tab title="Whitelist an IP">
    Whitelisted IPs bypass WAF inspection and automatic blocking entirely. Use this for trusted sources like monitoring services, payment provider webhooks, or your own office IP ranges.

    <Steps>
      <Step title="Find the IP in your Threat Feed or Block List">
        If the IP was blocked automatically or manually, find it in **Security → Block List**. If it hasn't been blocked yet, go to **Security → Allow List → Add IP**.
      </Step>

      <Step title="Click Whitelist">
        Click **Whitelist** next to the IP. The entry moves to your Allow List and the IP is immediately removed from all blocklists.
      </Step>

      <Step title="Add an optional note">
        Use the **Note** field to describe why the IP is whitelisted (e.g., "Pingdom monitoring", "Office - London"). Notes are visible to all team members.
      </Step>
    </Steps>

    <Warning>
      Whitelisted IPs skip all WAF rules, rate limiting, and geo-block checks. Only whitelist IPs you own or explicitly trust. Avoid whitelisting broad CIDR ranges unless necessary.
    </Warning>
  </Tab>
</Tabs>

## Geo and ASN blocking

Recon44 lets you block entire geographic regions, hosting providers, and known bad network ranges in one click — without managing individual IP addresses.

<AccordionGroup>
  <Accordion title="Country / region blocking">
    Block all traffic originating from a specific country. This is most useful when you are under a volumetric DDoS attack sourced from a single region, or when your product does not serve customers in that region at all.

    To block a country:

    1. Go to **Security → Geo Blocking**.
    2. Click **Add rule**.
    3. Select **Country** and choose the country from the dropdown.
    4. Click **Save**. The rule is active immediately.

    Traffic from the blocked country receives a connection drop at the edge. No response is sent.

    <Note>
      Geo-blocking affects all traffic from the selected country, including legitimate users. Review whether your site has any users or dependencies (APIs, partner services) in that region before blocking.
    </Note>
  </Accordion>

  <Accordion title="ASN blocking">
    An Autonomous System Number (ASN) identifies a network operated by a single organization — a hosting provider, ISP, or CDN. Blocking an ASN stops all traffic originating from that network's IP ranges.

    ASN blocking is particularly effective against:

    * **Hosting provider ranges**: Attackers frequently use cloud VMs (AWS, DigitalOcean, Linode, OVH) to run bots and scanners. Blocking the ASN for a hosting provider removes entire attack infrastructure in one rule.
    * **Known bad ASNs**: Recon44 maintains a curated list of ASNs with high abuse histories. You can enable the **Known bad ASNs** blocklist from **Security → Geo Blocking** with a single toggle.

    To block an ASN:

    1. Go to **Security → Geo Blocking**.
    2. Click **Add rule**.
    3. Select **ASN** and enter the ASN number (e.g., `AS14061` for DigitalOcean).
    4. Click **Save**.
  </Accordion>

  <Accordion title="Tor exit node blocking">
    Recon44 maintains an up-to-date list of Tor exit node IP addresses. Enabling Tor blocking drops all requests originating from the Tor network.

    To enable Tor blocking:

    1. Go to **Security → Geo Blocking**.
    2. Toggle **Block Tor exit nodes** to on.

    The list updates automatically as exit nodes change. You do not need to maintain it manually.

    <Info>
      Blocking Tor will prevent privacy-conscious users who use Tor for legitimate reasons from accessing your site. Evaluate this tradeoff for your audience before enabling it.
    </Info>
  </Accordion>
</AccordionGroup>

## How blocked traffic is handled

Blocked traffic — whether from an auto-blocked IP, a manually blocked IP, or a geo/ASN rule — is handled at the edge:

* The connection is **dropped before it reaches your origin server**. Your origin never sees the request, never allocates resources for it, and never logs it.
* The attacker receives no response (TCP RST or connection timeout depending on the protocol). This avoids confirming that the block rule fired.
* The block event is logged in your **Threat Feed** and **Audit Logs** with the full request metadata.

<Tip>
  Because blocked traffic never reaches your origin, IP blocking also reduces your server load and bandwidth during high-volume attacks. There is no cost on your infrastructure for blocked requests.
</Tip>

## Blocked vs. throttled vs. logged

These three actions appear in your Threat Feed and reflect different levels of enforcement:

| Action        | Traffic reaches origin? | What the attacker sees           | When it applies                                                         |
| ------------- | ----------------------- | -------------------------------- | ----------------------------------------------------------------------- |
| **Blocked**   | No                      | No response (connection dropped) | WAF rule matched in active mode, or IP is on block list                 |
| **Throttled** | Yes, at reduced rate    | Slow responses                   | Brute force / rate limit exceeded; IP not yet fully blocked             |
| **Logged**    | Yes                     | Normal response                  | Free plan (read-only WAF mode), or lower-confidence rule set to observe |

If a throttled IP continues suspicious behavior, Recon44 automatically escalates to a full block. You can also manually escalate from the Threat Feed by clicking **Block IP** on any throttled entry.

## Related pages

<CardGroup cols={2}>
  <Card title="WAF — How It Works" icon="shield-halved" href="/concepts/waf">
    Understand the rules that trigger automatic IP blocking.
  </Card>

  <Card title="Live Threat Feed" icon="chart-line" href="/concepts/threat-feed">
    View and act on blocked, throttled, and logged events in real time.
  </Card>

  <Card title="Geo-blocking guide" icon="globe" href="/guides/geo-blocking">
    Step-by-step walkthrough for setting up country and ASN block rules.
  </Card>

  <Card title="Blocking attacks guide" icon="shield" href="/guides/blocking-attacks">
    Practical playbooks for responding to DDoS, brute force, and scanner activity.
  </Card>
</CardGroup>