WordPress GeoIP, ASN, Behavioral Controls, and Browser Challenge: Use the Right Signal for the Right Decision
Aegisify WAF 1.20.13 combines several related controls without pretending they are one universal reputation score: explicit IP/CIDR blocking, optional country or ASN blocking from a configured provider, anonymous behavioral scoring, shared-memory request counters, and a signed browser challenge used when WAF or DDoS policy selects a challenge response.
Geo/ASN Blocking, Behavioral Rate Control, and Browser Challenge Are Separate Controls
The older “progressive GeoIP” framing can imply one automatic risk ladder. The 1.20.13 code is more precise: source block policy, behavioral scoring, and browser verification have different triggers and different enforcement paths.
Click a stage to expand
01Client IPTrusted source address
02IP / CIDRExplicit administrator block
03Geo / ASNOptional provider context
04BehaviorAnonymous request frequency
05ChallengeBrowser-capable verification
06EvidenceLog the security action
Use IP, Country, and ASN Policy Deliberately
These controls reduce unwanted exposure when an organization has a defensible business reason to limit specific sources or networks.
Direct Source Blocks
The Abuse & Bots intelligence panel supports one IPv4 address or CIDR range per line. Exact addresses and networks can therefore be blocked without waiting for a behavioral threshold.
ISO Country-Code Blocks
Administrators can provide comma-separated country codes. The rule activates only when the selected Geo/ASN provider returns a usable country code for the evaluated request.
Network-Owner Blocks
One ASN can be entered per line, such as AS13335. ASN enforcement requires a provider capable of returning ASN data; Cloudflare’s country-header mode does not supply ASN in this implementation.
Provider Failure Does Not Invent Location
If no provider result is available, Geo/ASN blocking returns no match. This is safer than guessing a location or treating unresolved traffic as automatically hostile.
Cloudflare Country Headers and Local MaxMind Have Different Capabilities
The provider setting is not just a brand selector; it changes what intelligence is technically available.
No Geo / ASN Enrichment
IP/CIDR policy can still operate, but country and ASN lists have no lookup result to evaluate. This is the appropriate state when the environment has not established a trusted enrichment source.
Current-Request Country Only
Aegisify can use the validated Cloudflare country header for the current request. The provider deliberately refuses to reuse that live header to geolocate an unrelated historical IP, and it does not return ASN in this mode.
Local Country + ASN Where Available
The MaxMind option requires the PHP MaxMindDB extension and an administrator-supplied local MMDB path. The UI warns not to place that database in a publicly downloadable directory.
Use Request Frequency and Sensitive-Route Context Before Rate Limiting
Behavioral intelligence adds a separate short-window signal that does not depend on GeoIP.
For anonymous traffic, Aegisify increments a shared-memory counter keyed by scope, client IP, and current minute. More than 30 requests contributes 30 points; more than 80 contributes an additional 40. Requests involving sensitive paths such as wp-login.php, xmlrpc.php, wp-admin, wp-json, or author-enumeration patterns add 25 points. The score is capped at 100.
The default behavioral block threshold is 80. On ordinary front-end traffic, reaching the threshold results in a 429 rate-limit response. In the REST path, the engine similarly returns a 429-style WAF error. Logged-in users are excluded, and routine authenticated REST reads are explicitly skipped.
Verify Browser-Capable Traffic Without Pretending Every Client Is a Browser
Challenge is a response mechanism used by WAF/DDoS policy; it is not the automatic result of a country or ASN match.
Signed, IP-Bound Challenge Token
The challenge token contains its issue time and an HMAC signature generated from the client IP and a WordPress salt. The verifier checks token format, future/expiry boundaries, and signature equality before accepting it.
Configurable Lifetime
The default and recommended challenge lifetime is 1,800 seconds, or 30 minutes. The admin control allows values from 300 seconds through one day.
Invalid Tokens Become Evidence
Malformed, expired, future-dated, or incorrectly signed challenge cookies can be logged using a short cookie fingerprint rather than placing the full token in the log record.
Four Rules for Using Geo and Network Context
Source intelligence can reduce exposure, but broad policy can also block legitimate customers, crawlers, partners, or remote administrators.
Reduce Unwanted WordPress Traffic Without Turning Geography Into a Security Verdict
Combine explicit source policy, short-window behavior, browser verification, and evidence so stronger actions are explainable and reversible.
Common Questions About Aegisify Source Intelligence
Does Aegisify automatically assign risk to countries?
No. Country blocking is an explicit administrator-maintained list. The current code does not implement an automatic country reputation score.
Can Cloudflare mode block by ASN?
Not from the built-in Cloudflare provider path shown in 1.20.13. That mode uses the current request’s country header and returns an empty ASN. Use a provider that supplies ASN data if ASN policy is required.
What happens if the shared counter backend is unavailable?
Counter-based controls such as behavioral scoring are designed to fail open. The WAF avoids using database transients for those request-path counters.
Does a GeoIP match automatically trigger a browser challenge?
No. Country/ASN blocks and browser challenge are separate enforcement paths. Challenge is used when WAF or DDoS policy selects a challenge response.
How can Aegisify AI help?
Ask about Aegisify or WordPress: errors, plugins, security, SEO, compatibility, troubleshooting, comparisons, or launch a free website scan.