First of all love this plugin,
The way I’m using it right now is to whitelist my ip and blacklist everything else with ... (Asterisks) so nobody except me can access the wp-login/wp-admin/wp_xmlrpc
But I think this happened like 3 times where I would check cerber Access list and the blacklist is empty, am I missing something?