Support

Did you follow all of the instructions of the troubleshooter page, including removing the user's IP address from the exceptions log and the automatic IP ban list?

I mean this one: https://www.akeebabackup.com/documentation/troubleshooter/atwafissues.html

The information under "Automatically banned IP address" applies in your case:

Go to Components, Admin Tools, Web Application Firewall and click the Exceptions Log button. Delete all records with your own IP address. Then, go back to Web Application Firewall and click on the Auto IP Blocking Administration button. Select the record showing your IP address and click on the Delete button to delete the block.

I suspect that you did not remove the records from the Exceptions Log. This means that the next time someone from that IP tries to access your site he will be eligible for auto-block (depending on your automatic IP blocking settings, of course). The automatic IP blocking runs before the whitelist. I hope this information helps.

The IP is automatically added in two places:
- Exceptions Log: added every time the user triggers the protection on your site
- Auto IP Blocking Administration: added when the user triggers the protection on your site too many times, per the automatic IP blocking configuration

Regarding the "Site IP Blacklist", IPs are added there only manually. I have to say this: this is a feature I discourage my clients from using. No, it is working just fine and that's the problem :) Once you put an IP in there, it is blocked from accessing Joomla!. For ever. That "forever" part is the problem. A hacker will not foolishly use the same IP for a long time. In fact, a real hacker will use a dynamic IP or a botnet to attack a site. By blocking an IP address forever you will end up blocking a client sooner or later. The automatic IP block is much better because it only blocks an IP for a limited amount of time, i.e. just as long as it's required to let an automatic attack from a single IP flame out. Well, consider this a free advice and better insight into what each type of IP blocking does. It's ultimately up to you to decide what works best for your site.