A WordPress site and its firewall show that brute-force protection is enabled.
Attackers are making thousands of login attempts from different IPs.
No IPs are getting banned, and the logs show everything as “allowed.”
The site is running behind a CDN and a load balancer.
Why do repeated failed login attempts not get blocked even though I enabled brute-force protection?
Benedict PierBegginer