Why is some traffic not blocked?

cPFence v4+ does not classify every connection as an attack. A source may be below the concurrent-connection limit, whitelisted, behind a proxy or using short-lived connections.

Check the intended address before changing protection. Select the image for full size; use browser Back to return.

1. Check the IP and compare current policy with incident history.
2. Review the configured Connection limit and proxy behavior.
3. If an account is consuming excessive resources, review its workload in Owl and LogSpot.
4. Set suitable account CPU and memory limits in Enhance based on observed usage, and use the relevant Owl account policy when needed.

Address the account workload

A CPU-heavy script can overload a site without exceeding an IP connection limit. Review the account’s processes and resource limits rather than raising global thresholds or assuming the firewall should solve every workload problem.

Use a specific block only after verifying the source and consequence. Preserve legitimate client, CDN and administrator access. See IPDB policies for controlled changes and recovery.