I am protecting several Wordpress sites with Wordfence.
From the alerts for attempted logins a few things are clear:
a. They are using an automated system to try and login
b. That they are not smart because they are using the same logins over and over (on different IP's)
c. That they are using proxy IP addresses
d. That they use the same IP's again even if they have been banned
What would be useful would be
1. Loading a central list of banned IP's either from one of my own domains or one at Wordfence. That list to be optionally updated by the plugin with the IP address of failed attempts.
2. For Wordfence to automatically add the Blocked IP's from failed login attempts to the banned IP list
3. For me to be able to share blocked sites between my own sites.
4. For me to be able to ban IP's permanently rather than for just 60 days.
5. To be able to paste a list of banned IP's rather than one at a time.
6. A facility to automatically add free proxies from certain URL's and sources.
7. A facility to automatically ban IP's that try to access certain URL's that we know are searching for e.g.
http://%domain%/wp-content/uploads/wysija/themes/tmp/OxmoE.php
http://%domain%/wp-content/themes/twentyten/includes/uploadify/upload_settings_image.php
http://%domain%/wp-content/plugins/category-grid-view-gallery/includes/timthumb.php
http://%domain%/plus/xsvip.php
http://%domain%/downloader/
http://%domain%/public/FCKeditor/editor/filemanager/browser/default/browser.html
8. The blocking of networks needs to be simplified, so if I see some Chinese or Ukraine proxy being used to hack my site when I look at Live traffic and pages not found, right now I have to click on Block Network, it does a lookup and I have to click a link and make a reason why comment. What I want is it to just prompt me for the reason why, I do not need Chinese traffic, I do not need Chinese IPS's that do not run secure networks. The same applies to Ukraine Russia, Poland, Romani, Latvia.