Troubleshoot

Stopped vs Blocked Attack Status in Astra

What does ‘Stopped’ Next to the Threat Means?

The ‘Stopped’ status means that attack on your website has been stopped by Astra. Example: Someone tried to inject SQL Injection payload in your website, that attack was ‘stopped’ by Astra and hence, it’s under stopped status.

What does ‘Blocked’ Next to the Threat Means?

‘Blocked’ means that a person tried a number of attacks which we stopped by Astra and now they have been temporarily ‘blocked’ by Astra. This means, due to continuous attacks and IP has been blocked from accessing the website. The moment they visit your website, they will see Astra’s blocked page.

Please note: If a ‘blocked’ IP continues accessing your website, they’ll still be seen in the Astra dashboard under status ‘Blocked’.

Criteria for Blocking

To check Astra mode go to your ‘Settings’ Page -> Astra Mode

When Astra on your website is in ‘Low’ mode:

  • When from one IP there are continuous 5-10 ‘stopped’ attacks, their IP gets blocked for 15-60 minutes

When Astra on your website is in ‘Medium’ mode:

  • When from one IP there are continuous 5-10 ‘stopped’ attacks, their IP gets blocked¬† for 100-300 minutes

When Astra on your website is in ‘High’ mode:

  • When from one IP there is even 1 attacks, their IP gets blocked directly

Note: In case of bad bots, if Astra is 100% confident that the bot is a definite bad bot – then it’s immediately blocked regardless of the above mode.

Also, there are multiple other criteria on which blocking could happen. Astra takes the best decision in real-time to protect your website.

Was this helpful?