Support

Go to Components, Admin Tools, Web Application Firewall and click the Exceptions Log button. Delete all records with her IP address. Then, go back to Web Application Firewall and click on the Auto IP Blocking Administration button. Select the record showing her IP address and click on the Delete button to delete the block.

The message you mentioned she is seeing is only presented to people in the automatic IP ban list. If her IP is not in that list that message is not displayed. Something in your description doesn't add up. You can't both see the message and her IP not be in the auto banned IP list. These are mutually exclusive.

Regarding the whitelist, please note that it only works if you have enabled the IP whitelisting feature in the Configure WAF page. Otherwise it is ignored. If you do enable it please remember that only IPs in that list will be able to access the back-end of your site.

> We do have thousands of listings in our Geo block list

Are we still talking about Admin Tools? GeoBlock only allows you to select which continents and/or countries to block. There are a few hundreds options in total, but thousands they are not. And they are certainly not IPs and not searchable. I am confused. What are you talking about?

> As for the whitelist info, that clears it up because I had not activate the whitelist feature at the top of the configuration page. I did not realize it was connected with the list at the bottom of the page.

I am not sure we're talking about the same thing. Whitelist is what you define in the IP Whitelist page of Admin Tools. There are also two fields for allowed IPs in the Configure WAF page, but these two fields are not linked with the whitelist and do not require turning on the whitelist feature.

> If we do active the whitelist feature, would that override any other IP bans in Admin Tools?

All addresses in the whitelist (if the whitelist feature is enabled) and all IPs in the allowed IPs pass through all the checks. Please note that the allowed IP fields only accept a comma separated list of single IPs, not IP ranges, CIDR blocks and netmasked addresses.

I just realised that you're using Joomla! 1.5 with AdminTools 2.2. I know what the problem is with your version and it was changed a few months ago, for Joomla! 2.5, 3.0 and 3.1. It cannot be backported to Joomla! 1.5 as we've stopped supporting that version of Joomla! too long ago. Your only option is to disable GeoBlock and empty both the security exceptions log and the automatic IP ban administration list.

It's time for one of my infamous car analogies.

I have a car which is 20 years old. Its brakes are useless, it's chassis is rusty and falling apart, it can't do more than 50 mph and it can be lockpicked by an untrained monkey in thirty seconds flat. This car is the main vehicle which I use to conduct business. Without a car my business is gone. I do not see a compelling reason to spend a few grand to buy a faster, more economic, safer car (the cost of obtaining the original car and its customisations). And that doesn't include the cost of retraining* my employees who are very familiar with my rusty old car.

* Yes, newer cars have all those extra gizmos that require a minimum amount of training before you can actually say you can drive a car safely.

In so many words: you are using a Joomla! version which is not supported for a year. It can't even run reliably on PHP 5.4. PHP 5.3 has already gone end of life. This means that in the next 12-24 months you will have the option to stop having a site (unlikely), use an outdated server with outdated software (you'll get hacked) or rebuild your site. You will choose the latter option.

As most people do, you'll act emotionally and think that it's all Joomla!'s fault and you'll rebuild your site with an entirely different CMS. This will cost you 3x as much to build it (data migration costs a LOT) and require 20x as much training.

Or you could spend the 3 grand today. You can then factor in another grand per year or less for updates, renewals and so on. I hear you shouting "heresy! that's too expensive". Newsflash. No matter which CMS you choose (be it Joomla!, WordPress, or worse like Drupal and various proprietary CMS) you can either sit on the old unmaintained code until it rots and needs a bucketload of cash to rebuild everything or you can factor in the cost of maintenance. The latter allows you to have a secure, fast and usable site. This is true for any CMS.

And something more. Going from Joomla! 1.5 to 2.5/3.x is a HUGE job. Going from 2.5 to 3.x or from one 3.x version to another (e.g. 3.0 to 3.1) is an one click upgrade. All you need is the newer version of the extensions you use and minor changes in your template. Knowing the low prices of Joomla! extensions and that having over 50 extensions on your site leads to an unusable frankensite I think that you need less than a grand per year. Compare that with WordPress or Drupal where anything not strictly in the core requires customisation at $50-350 per hour.

Well. I guess 3 grand today is more expensive than the rushed upgrade that will cost way much more than that in 1-2 years.

PS: This site has gone through Joomla! 1.0, 1.5, 1.7 (OK, that version of the site wasn't live) and 2.5. I know all the issues involved. And I know very well why I spent my time upgrading the site and not sticking with, say, Joomla! 1.0.