Removing a Block
Removing a block takes a moment. Knowing which ones should go is the part that needs a habit.
Where to find it
Architect Panel → Security:
- Blocked IP Addresses — the register
- Security Settings — the ban length automatic entries follow
Automatic entries
Leave them alone. They lapse on their own, and removing one only makes sense when somebody legitimate is waiting and cannot afford to.
If you find yourself clearing automatic blocks regularly, the threshold does not suit your users — fix the setting rather than the symptom.
Manual entries need a review
Because nothing removes them, a manual block outlives the reason for it. Review them periodically — quarterly is enough for most organisations — and for each one ask:
- Do we know why this was added?
- Is that reason still current?
- Is there any evidence of continued abuse from it?
Remove blocks you cannot explain
This is the recommendation people resist, so it is worth the argument.
An unexplained block is not protecting you from anything you can name, and it may be silently breaking access for somebody. Addresses get reassigned; the address that belonged to an attacker two years ago may belong to a customer now, and they will experience your system as simply broken, with nothing to tell them why.
If a block is genuinely still needed, removing it will produce evidence quickly and you can add it back — with a reason this time.
Watch after removing
Check the automatic entries over the following days. A genuinely hostile address will trip the automatic rule again promptly, which both tells you the block was justified and re-blocks it while you decide.
Do not clear the whole list
Tempting when it is long, and a bad idea — it discards the manual decisions along with the noise. Automatic entries clear themselves; there is never a good reason to bulk-delete.
If a user is still blocked afterwards
Check the account list. Address and account bans produce identical symptoms, and clearing one while the other stands is the commonest reason a lock-out "will not go away".
Worked example
A quarterly review finds nine manual blocks. Six have tickets explaining them and remain justified. Three are unexplained and over a year old; they are removed and the list is watched for a fortnight. None reappears — one of them turns out to have been a customer's new office connection, which had been failing silently for months.
Recommendations
- Review manual blocks quarterly.
- Remove anything you cannot explain, and watch afterwards.
- Never bulk-clear the list.
- Check the account list too when a lock-out persists.