Quote Originally Posted by HeathenMagic View Post
Thats great! I can confirm it is all working perfectly. I have enabled most of the settings that I understand, octet, flood, and session rate limiting. I think the module doesn't automatically block the IP, I refer to whos online and add to the blacklist text file? I have started doing that, and enabled the blacklist execution anyway.
Great to hear it’s working now!

The module does automatically block IPs when their AbuseIPDB confidence score exceeds the threshold you’ve configured — no need to manually blacklist them. That part is handled in real time.

As for the features you enabled:

Octet blocking looks for too many hits from the same IP range (e.g. 123.45.67.*) and can block the entire subnet if abuse is detected.

Flood control has multiple layers — depending on which option is enabled, it can detect surges from foreign countries or large volume from specific subnets.

Session rate limiting watches for how quickly new sessions are created and blocks IPs exceeding the limit.

Each setting has its own logic and threshold — and the README walks through all of them in detail. Give it a look when you can.