The Wordfence “Live Traffic” page feed shows you what is happening on your site in real-time. Wordfence logs your traffic at the server level which means it includes data that JavaScript-based packages like Google Analytics do not show you. As an example, Live Traffic shows you visits from Google’s crawlers, hack attempts, and other visits that do not execute JavaScript. Typically Google and other analytics packages will only show you visits from web browsers that are operated by a human.

Wordfence Live Traffic is real-time so it will update as new visits appear on this page. Note that by default the traffic is updated every two seconds. If you want to change this update frequency you can go to your Wordfence options and change the update interval.

Understanding a Live Traffic record

Location
In most cases, we will show the city that the IP address visiting your site originates from. Where we do not have that data we will show a country or “unknown”. This data is 95% accurate and is based on a commercial IP to city database that we use to resolve IP address locations.

IP Address
The IP address is the source address that is visiting your site. You can click on the “See Recent Traffic” button to see all recent hits from this IP. You can also click the “Run WHOIS” button to find out who the owner of an IP address is. You can also click the “Block IP” button to block that IP address.

Note that if you use the button to block an IP address it is a temporary block controlled by the option “How long is an IP address blocked when it breaks a rule”. You can find this option in the “Rate Limiting” section on the “Firewall Options” page.

If you want to permanently block an IP address then you can find the temporary block you just created by opening the “Blocking” tab on the “Firewall” page. The block will be listed with an expiration time in the “Current blocks” section. You can select that block using the checkbox and then use the “Make Permanent” button. If you are considering manually blocking many IP addresses then this is not always the best solution. See details from our research in the post Ask Wordfence: Should I Permanently Block IPs That I See Wordfence Blocking?

Time
We show you the absolute time of the request. We also show you the relative time of each visit as relative time, in terms of how many seconds, minutes, and hours ago the visit occurred. The time displayed is based on your internet browser (your computer) time and not the time defined in your WordPress settings.

Browser
You will see the “User-Agent” that the visitor’s browser has sent, which includes details about their browser, or it may be a custom description for bots. An example User-Agent looks like this:

Mozilla/5.0 (Windows 98; en-US; rv:1.9.1.20) Gecko/20161228 Firefox/36.0

The options available for each hit
We provide shortcuts to block the IP address, block the network the IP address originated from, run a “WHOIS” to find out who an IP address belongs to, and see recent traffic from an IP address.

Note that the option to block the network an IP address belongs to is a two-step process. The button will open a drawer that does a WHOIS lookup in Wordfence and show you who an IP address belongs to and what the network is for that IP. In that drawer, you will find options to block the network, which when clicked will take you to our blocking page and give you the opportunity to block the network the IP belongs to.

Options

Traffic logging mode

You can choose to log all traffic or only security-related traffic on the Live Traffic page feed. We recommend logging only security-related traffic, which includes successful logins, login attempts, and various types of blocked requests. As of Wordfence 7.2.3, you may see a prompt on the Wordfence dashboard suggesting switching to the security-only setting. This is now also the default setting on new installations of Wordfence.

If you are using a low-cost hosting plan that limits the resources you have available, choosing “Security Only” is recommended, to reduce the load on your web server. If you still choose to log all traffic, it will allow you to see regular page views and other traffic that is not blocked, and it adds an additional request for each visitor, to better distinguish human versus bot traffic. This may improve accuracy if you use rate-limiting settings that are different for human and bot visitors.

If Live Traffic has a message stating “Security-related traffic only (host setting)” at the top of the page, this means that your host or a developer on your site has set Wordfence to only log security-related traffic. This is most likely for database performance and generally should not be changed.

Don’t log signed-in users with publishing access

If you don’t want administrators and editors to show up in Live Traffic, keep this option enabled.

List of comma separated usernames to ignore

This option allows you to exclude certain logged in users from Live Traffic.

List of comma separated IP addresses to ignore

This option allows you to exclude certain IP addresses (such as your own for example) from Live Traffic.

Browser user-agent to ignore

This option allows you to exclude certain User-Agents (browsers) from Live Traffic. You may use this if you are running external scanners or other remote services on your site that you do not want to see in Live Traffic.

Amount of Live Traffic data to store (number of rows)

This option limits the amount of database space that is allocated to Wordfence Live Traffic. If you are on hosting with limited resources, or if you are having issues with a slow database connection then you can lower this value. If you are on a high-performing site with lots of visitors, you could increase it.

Maximum days to keep Live Traffic data

Along with the number of rows, you can also limit Live Traffic data by the number of days since a visit was logged. The default is 30 days, and the minimum is 1 day. Limits are checked daily, and records over the limit are removed at that time.  Note that you cannot record data for more than 30 days.

Different types of Traffic

Referer spam

Referer spam (also known as Referrer spam) can be of two primary types:

Bot hits
A bot visits your page and pretends it is coming from somewhere it is not actually coming from. It is spoofing (faking) the HTTP_REFERER header. Your page loads the tracker code and is then fooled into submitting incorrect information to your external traffic analytics tool. Bot hits will be visible in the Wordfence “Live Traffic” feed. This type of referrer spam can be stopped by blocking requests to your site that have a particular HTTP_REFERER. In Wordfence you can block this type of referrer spam by entering the referrers you would like to block using the “Referrer” custom pattern blocking feature.  This found feature is found via the “Blocking” tab on the “Firewall” page.

Ghost hits
A bot uses your JavaScript code, linked to your external traffic analytics tool, on a completely different site and submits fake traffic directly to your tracking service. Ghost referrer spam never reaches your web server. Thus this traffic will not be visible in your Wordfence Live Traffic page feed and it is not possible to stop this traffic by adding any code or blocking rules to your site. Instead, you have to set filters in your analytics tool to filter out such traffic from your results.

Using the advanced filters

There are four filter operators you can use for advanced searches of requests and activity. Instructions are also provided for when wildcards can be used.

Operator types

EQUALS (=)

Finds exact matches only. Use when you know exactly what you’re looking for.

Example:

HTTP Response Code = 404

Shows only pages that returned a 404 response code.

NOT EQUALS (≠)

Shows everything except what you specify. Use when you want to exclude something specific.

Example:

HTTP Response Code ≠ 200

Shows all response codes other than 200 (200 means “OK”).

CONTAINS

Finds anything that has your text somewhere in it. Use when you’re looking for partial matches.

Example:

URL contains wp-admin

Finds any request with “wp-admin” in the URL.

IMPORTANT:  This operator cannot be used with IP addresses. This is because of how Wordfence stores IP addresses in your database. Instructions for IP searches are further below.

MATCH

Like CONTAINS but supports a wildcard. Use when you need flexible pattern matching.

Example:

URL match *.pdf* 

Finds all requests for PDF files.  We recommend adding an asterisk at the end in case of query strings.

Using wildcards (*)

Wildcards let you match patterns.  The asterisk (*) means “anything can go here”

Where wildcards work:

IP addresses with any operator:

IP = 192.168.*

Any field with MATCH operator:

URL match */wp-admin/*

HTTP Response Code match 40*

Where wildcards DON’T work:

With CONTAINS operator (asterisk is treated as a literal asterisk).

With EQUALS operator (except IP addresses which have special handling).

Examples:

IP = 10.10.10.*

Works and (shows all IPs starting with 10.10.10)

URL match *.pdf*

Works and shows all PDF file requests, and we recommend adding an asterisk at the end in case of query strings.

HTTP Response Code match 40*

Works and (shows all 40x errors such as 400, 403, 404, etc.)

URL contains *.pdf*

Doesn’t work as it looks for literal “*.pdf*”.

URL = *.pdf*

Doesn’t work as it looks for literal “*.pdf*”.

Filter Types with text input fields

Here are the filter types with text input fields with example queries.

Username

• Username = admin (shows activity from the user with the username called “admin”)
• Username contains test (shows any username with “test” in it)
• Username match admin* (shows activity from usernames such as “administrator”, “admin123”, etc.)

User ID

• User ID = 0 (shows anonymous visitors and failed logins with non-existent usernames)
• User ID ≠ 0 (shows logged-in user activity and failed login attempts for valid user accounts)
• User ID = 1 (shows activity related to the user ID of 1, usually the first created admin on the site, including failed login attempts for that account)

IP

• IP = 192.168.1.1 (shows requests from one specific address)
• IP = 192.168.1.* (shows requests from 192.168.1.0 to 192.168.1.255 – the asterisk wildcard means “any IP octet number”)
• IP ≠ 10.10.10.* (hides requests from the range of 10.10.10.0 to 10.10.10.255)

IMPORTANT: The CONTAINS operator doesn’t work properly with IP addresses. Always use EQUALS or NOT EQUALS, and an asterisk wildcard instead if needed.

User Agent

• User Agent contains bot (shows requests likely from a bot)
• User Agent match *iphone* (shows iPhone users, unless the User Agent is being spoofed – also note that User Agent strings can contain the names of multiple browsers so can be inaccurate)

Referer

• Referer contains google (shows requests coming from Google search engine)
• Referer match *.facebook.* (shows requests coming from Facebook)

URL

• URL contains wp-admin (shows admin area access requests)
• URL match *.php* (shows all PHP page requests, and we recommend adding an asterisk at the end in case of query strings)
• URL = https://example.com/ (shows home page visits due to the exact match with your full domain)

HTTP Response Code

• HTTP Response Code = 404 (shows all requests with a “page or resource not found” response)
• HTTP Response Code ≠ 200 (shows all informational, redirect and error responses)
• HTTP Response Code match 40* (for all 40x error responses such as 401, 403, 404 etc.)

Security Event

There are various security events that you can search for. Here are queries below that you can use.

Login page related activity:

• Security Event = loginOk (successful logins)
• Security Event = logout (successful logouts)
• Security Event = lockedOut (IP addresses locked out from the options “Lock out after how many login failures” and “Lock out after how many forgot password attempts”)
• Security Event contains loginFail (failed logins for valid or invalid usernames)
• Security Event = loginFailValidUsername (failed logins for valid usernames)
• Security Event = loginFailInvalidUsername (failed logins for invalid usernames)
• Security Event = lostPassword (password reset form used)
• Security Event = user:passwordReset (successful password reset)

Firewall rule blocking and Premium Real-Time IP Blocklist feature blocking:

• Security Event = blocked:wordfence (blocking carried out by custom blocking rules in the plugin such as a “Browser User Agent” custom pattern blocking rule. It also shows blocks for the brute force login option “Immediately block the IP of users who try to sign in as these usernames”)
• Security Event = blocked:wfsn (blocking carried out by the Wordfence Security Network – https://www.wordfence.com/help/firewall/brute-force/#wordfence-security-network)
• Security Event = blocked:waf (blocking carried out by firewall rules and the Premium Real-Time IP Blocklist)

Combining multiple filters

When you use multiple filters, Wordfence combines them with specific rules.

The same filter type equates to OR, which shows any match if you add multiple filters for the same filter type:

Example:

IP = 192.168.1.1

IP = 192.168.1.2

Shows requests from either IP address.

Different filters equate to AND, which must match all filters if you add different filter types.

Example:

IP = 192.168.1.1

HTTP Response Code = 404

Shows only 404 errors from that specific IP

The problem with the multiple use of the NOT EQUALS operator is that it doesn’t work as expected:

IP ≠ 192.168.1.1

IP ≠ 192.168.1.2

This shows all requests as this combination doesn’t exclude anything properly. When you create two filters like this you might think this means, “Don’t show me requests from either of these IP addresses”. But that’s not what happens. Instead, you see all requests, including from both IP addresses! Wordfence combines multiple filters on the same parameter using OR logic, which means “show me records that match ANY of these conditions.” So your filters actually mean:

“Show me requests where (IP is not 192.168.1.1) OR (IP is not 192.168.1.2)”

Every single IP address will pass this filter because:

If it’s IP #1, then it’s automatically “not IP #2” (making the second condition true)

If it’s IP #2, then it’s automatically “not IP #1” (making the first condition true)

If it’s neither (making both filters true)

Since OR means at least one condition must be true, and at least one condition is ALWAYS true for any IP, then everything from all IP addresses gets shown.

Tips for success

– Use one filter at a time until you understand how each works.

– Test your filters by apply them and check if the results match what you expected.

– Use CONTAINS for text. When searching URL’s, Usernames, or User Agents then “CONTAINS” is usually easiest.

– Watch for the AND/OR Logic. Remember the same filter type uses OR but different filter types use AND.

– Be Careful with NOT EQUALS as multiple NOT EQUALS with the same filter type usually doesn’t work as expected.

Common mistakes to avoid

– Using CONTAINS with IP addresses:

Wrong: IP contains 192.168

Right: IP = 192.168.*

– Expecting wildcards with EQUALS:

Wrong: URL = *.php* (looks for literal “*.php*”)

Right: URL match *.php* (we recommend adding an asterisk at the end in case of query strings)