<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><style> body { font-family: "Calibri","Slate Pro",sans-serif,"sans-serif"; color:#262626 }</style> </head> <body lang="en-US"><div>I see a fair amount of hacking attempts in the access.log. That is, they show up with a return code of 400 (malformed). Well yeah, they are certainly malformed. But when I add the offending IP address to my blocked list, they still show up as malformed upon subsequent readings of access.log. That is, it appears to me that nginx isn't checking the blocked list first.</div><div><br></div><div>If true, shouldn't the blocked IPs take precedence? </div><div><br></div><div>Nginx 1.10.1 on freebsd 10.2</div><div><br></div><div></div><br></body></html>