Activity and blocking
Suspicious activity
What the connectors watch for, how IPs are ranked, and what IP details show.
Free, and on the site itself. Addresses never leave it, except for the one lookup you choose to run.
What's watched
- Probes for secrets and admin tools:
/.env,/.git, backups,wp-login.php,phpmyadminand the like - Failed sign-ins: on any guard in Laravel and Filament, the control panel in Statamic and Craft
- Bursts of 404s, and floods of form posts
Only those requests are recorded, so normal page views cost nothing. Counts are kept in the site's cache for 48 hours, and usernames only as keyed hashes.
An IP is flagged after 3 probes or 10 failed sign-ins in an hour, or 60 404s or 20 form posts in ten minutes. Each threshold can be changed: see Settings.
Production only. A local or staging copy records nothing unless PORRO_ACTIVITY=true, since its own traffic is noise. Blocks apply everywhere.
The list of IPs
The IPs worth a look in the last 24 hours, worst first. Each shows its country, what it tried, its last request and when, and Block 7 days, Block permanently and Safelist buttons. Every one of those asks first, in a confirmation that says what will happen to whom and for how long.
Badges lift an IP up the list or drop it down:
| Badge | Means |
|---|---|
| Tor | A Tor exit node |
| Spamhaus | On Spamhaus's DROP list of hijacked and criminal networks |
| Fake crawler | Says it's Googlebot or Bingbot, but its address isn't theirs |
| Hosting | A hosting provider's network, not a home connection |
| Scanner, low risk | A known research scanner such as Censys: noisy, but harmless, so it sits at the bottom |
Exposed files: if /.env or /.git ever answers rather than 404, that's raised as Act now on Site health.
IP details
Click an IP for:
- Who it is: country, network, and a reverse-DNS hostname, kept only when it resolves back to the same address. With a Cloudflare token, the network's type and Cloudflare's risk categories too.
- A plain note about crawlers: when the user agent says Googlebot or Bingbot, whether the address really is the search engine's, and what blocking it would mean.
- What it did here: signals per hour over 48 hours, and its last requests.
- Actions: block it, block its /24 (offered only for hosting networks, where it won't catch neighbours), or safelist it.
- Reputation: with
PORRO_ABUSEIPDB_KEY, a button checks AbuseIPDB. That's the one lookup that sends the address anywhere, so it only runs when clicked.
Results are cached for a day per address.
Where countries come from
From Cloudflare's header when the site is behind Cloudflare, for free. Otherwise from DB-IP's free country file, downloaded monthly into the site's storage.