In reply to Jacobus.

So what happens when you are under attack.

In my experience, you're almost always under attack. If your WordPress site is public, some folks will be trying to log in.

Jetpack Protect doesn't have different modes, it always protects your site, as long as the module is active.

Jetpack will only block IPs that failed to log in multiple times. If one provides the right username / password combination, they'll be able to get in, as long as they didn't fail to provide the right credentials multiple times in a row before that.

The whitelist is only there to allow some IPs to never be considered as malicious on your own site. If you never remember your password on your own site and usually have to try a lot of username/password combinations before to be able to get in, then the whitelist is for you!

The whitelist is also useful when you always access your site from the same IP. It allows you to make sure that you'll never be blocked by mistake.