=== Advanced IP Blocker === Contributors: inilerm Donate link: https://donate.stripe.com/bJe00kaIP89O1wFfargUM00 Tags: security, firewall, geoblock, ip block, honeypot Requires at least: 5.5 Tested up to: 6.8 Stable tag: 8.3.7 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Block IPs by country (Geoblock) or behavior. A lightweight, intelligent firewall with honeypot traps to secure your site. == Description == **Advanced IP Blocker** is your first line of defense against automated bots and malicious actors. Instead of relying on massive, pre-made blocklists, this plugin intelligently blocks IPs based on their real-time actions on *your* site. This provides a lightweight, efficient, and highly effective security layer. **Key Features:** * **Country Blocking (Geoblocking):** Easily block access from entire countries with just a few clicks. * **Behavioral IP Blocking:** Automatically blocks IPs that generate too many 404 (Page Not Found) or 403 (Forbidden) errors. * **Login Protection:** Thwarts brute-force attacks by blocking IPs after multiple failed login attempts. * **Honeypot System:** Instantly blocks bots that scan for common vulnerabilities by trapping them in "honeypot" URLs. * **User-Agent Filtering:** Block known malicious User-Agents from bots, scrapers, and vulnerability scanners. * **Whitelist Control:** Easily create whitelists for IPs and User-Agents (like search engine bots) to ensure they are never blocked. * **Active Session Management:** View all logged-in user sessions, see their location, and terminate them remotely if needed. * **Detailed Logging:** Keep a clear audit trail of all blocks, unblocks, and security events. * **WP-CLI Ready:** Manage every aspect of the plugin directly from the command line, perfect for developers and system administrators. * **Lightweight and Performant:** Designed to have a minimal impact on your site's performance. This plugin gives you the power to see who is trying to access your site and to stop threats before they become a problem. == Installation == 1. Upload the `advanced-ip-blocker` folder to the `/wp-content/plugins/` directory. 2. Activate the plugin through the 'Plugins' menu in WordPress. 3. Go to `Settings > Advanced IP Blocker` to configure the options. Your administrator IP will be automatically whitelisted on activation. == Recommended Setup == To get the most out of Advanced IP Blocker, we recommend the following initial configuration after installation: 1. **Enable Core Features in the "Settings" Tab:** * Navigate to `Settings > Advanced IP Blocker`. * **Enable Logging:** Check this box to keep a detailed record of all security events. This is crucial for auditing and understanding potential threats. * **Configure Email Notifications:** * Check "Enable Email Notifications" to receive alerts. * Choose your preferred "Notification Frequency" (`Instant` for immediate alerts, or `Daily`/`Weekly` for summaries). * Enter your email address. **Important:** Add this email address to your contacts to prevent notifications from going to spam. * **Review Thresholds:** The default thresholds for 404, 403, and Login errors are a great starting point. You can adjust them later if you find they are too sensitive or not sensitive enough for your site's traffic. 2. **Activate User-Agent Blocking:** * Go to the **"User Agents"** tab. * The plugin provides a list of "Common User-Agent Suggestions to Block". These are well-known scanners, malicious bots, and scrapers. * **Copy** the entire suggested list and **paste** it into the "Blocked User-Agents List" text area. * Click **"Save User-Agent Lists"**. 3. **Activate Honeypot Traps:** * Go to the **"Honeypot URLs"** tab. * Similar to User-Agents, the plugin provides a list of "Common URL Suggestions to Block". These are URLs frequently targeted by bots looking for vulnerabilities. * **Copy** the entire suggested list and **paste** it into the "Honeypot URLs List" text area. * Click **"Save Honeypot URLs"**. That's it! With these three steps, your plugin is now actively configured to block a wide range of common automated attacks, providing a robust layer of security for your website. == External Services == This plugin uses third-party services to provide IP geolocation data, which helps identify the origin of a visitor. This information is displayed in the "User Sessions" and "Blocked IPs" tables. The use of these services is optional and can be configured in the plugin settings. * **Service:** Geolocation APIs. * **Data Sent:** When geolocation is needed, the IP address of the visitor is sent to the third-party service selected by the administrator. No other user data is transmitted. * **Provider Links (Terms of Service & Privacy Policy):** * ip-api.com: [Terms of Use & Privacy Policy](https://ip-api.com/docs/legal) * geoiplookup.io: Provided as a free service. Link to service: [https://geoiplookup.io/](https://geoiplookup.io/) * geoiplookup.net: [Terms of Use](https://www.maxmind.com/en/terms-of-use) | [Privacy Policy](https://www.maxmind.com/en/privacy-policy) * ipinfo.io: [Terms of Service](https://ipinfo.io/terms-of-service) | [Privacy Policy](https://ipinfo.io/privacy-policy) * ipapi.com: [Terms of Use](https://ipapi.com/terms) | [Privacy Policy](https://ipapi.com/privacy) * ipstack.com: [Terms & Conditions](https://ipstack.com/terms) | [Privacy Policy](https://ipstack.com/privacy) This plugin also uses Stripe for processing donations. No user data is sent to Stripe unless a user voluntarily clicks on a donation link. * **Service:** Stripe, Inc. * **Links:** [Terms of Service](https://stripe.com/legal/end-users) | [Privacy Policy](https://stripe.com/privacy) == Frequently Asked Questions == = Does this plugin slow down my website? = No. The plugin is designed to be extremely lightweight. Most of the intensive operations happen in the WordPress admin area. For regular visitors, the checks are based on highly efficient WordPress transients (cached data), resulting in a negligible impact on page load times. = How does Country Blocking (Geoblocking) work? = This feature allows you to block all visitors from specific countries you select. It uses an external geolocation service (configurable in the settings) to determine the visitor's country based on their IP address. To be highly efficient, the plugin only checks the country for new, unknown IPs. Once an IP from a blocked country is identified, it is added to a permanent block list, so no further API calls are needed for that IP. **Important:** Be careful not to block the country where your server is located, as this can interfere with your site's internal functions (like cron jobs). The plugin will warn you if you attempt to do this. = What is a "Honeypot"? = A honeypot is a trap for bots. Bots often scan for specific files or URLs that are known vulnerabilities (e.g., `wp-config.php`). By adding these to the Honeypot list, you can instantly block any bot that tries to access them, as no legitimate user would ever request those URLs. = Which Geolocation Provider should I use? = For most users, **geoiplookup.net** is the recommended choice as it's free and uses a secure (HTTPS) connection without requiring an API key. If you need higher request limits, consider getting a free or paid key for one of the other supported services. = Can I manage the plugin without logging into WordPress? = Yes! The plugin has full WP-CLI support. You can block/unblock IPs, manage whitelists, view logs, and change settings directly from your server's command line. Run `wp help advaipbl` for a full list of commands. = What is "Whitelist Login Access" and when should I use it? = This is a very powerful security feature found in the "Failed Login Blocking" section of the settings. When enabled, it completely blocks access to the WordPress login page (`wp-login.php`) for **every IP address that is NOT on your whitelist**. **This will stop 100% of brute-force login attacks.** However, you should use it with extreme caution: * **DO NOT USE** this feature if you have a public website where users need to register or log in (e.g., WooCommerce stores, membership sites, forums). It will block your customers. * **ONLY USE** this feature on private sites where only a few administrators with known, static IP addresses need to log in. * **ALWAYS** ensure your own IP address and your server's IP address are on the whitelist before enabling this feature. The plugin will warn you if they are not. If you get locked out, you will need to use WP-CLI to disable this feature or add your IP to the whitelist. == Screenshots == 1. The main Settings page where you configure general options and thresholds. 2. The advanced Blocked IPs table with filtering, sorting, and pagination. 3. User-Agent management with both block and whitelist capabilities. 4. The User Sessions dashboard to monitor and terminate active sessions. 5. The Honeypot URLs configuration screen. 6. The IP Whitelist management tab. 7. Example of the 404 Error Log table. 8. Example of the 403 Error Log table. 9. The General Log for auditing all plugin actions. 10. The Credits tab showing plugin information. 11. WP-CLI commands list available for developers. 12. An example of an instant email notification. 13. Country Blocking (Geoblocking) == Changelog == = 8.3.7 = * **NEW SECURITY FEATURE: Whitelist-Only Login.** A new, highly-secure option has been added to completely restrict access to the `wp-login.php` page, allowing only IPs from the whitelist. This provides a powerful defense against all brute-force attacks. * **NEW SECURITY FEATURE: User Enumeration Protection.** Added two new options (enabled by default) to prevent bots from discovering usernames via REST API endpoints and author archive scanning (`?author=1`), significantly hardening your site against targeted attacks. * **ENHANCEMENT:** All email notifications (including for threshold-based blocks) now use a professional HTML template with the plugin logo and a "View Blocked IPs" button for better user experience. * **FIX:** Resolved an issue where the new "Login Failure Log" tab was not being displayed correctly. It is now fully functional and shows detailed information, including the attempted username. * **FIX:** Corrected a bug in WP-CLI that caused warnings or errors when managing the geoblock list and other settings. All WP-CLI commands are now fully functional and log their actions. = 8.3.6 = * FIX: Buttons to save changes in the configuration tab * Tweak: Updated Spanish translations. * Tweak: Updated internal image assets for a refreshed look. = 8.3.5 = * Tweak: Updated internal image assets for a refreshed look. = 8.3.4 = * **NEW FEATURE: Login Failure Log Tab.** A new dedicated "Login Log" tab has been added to the admin panel, allowing administrators to easily view all failed login attempts, including the IP address and the username that was attempted. This completes the set of security logs, providing full visibility into all types of automated attacks. * **ENHANCEMENT: Interactive Admin Notices.** The contextual warnings (e.g., when blocking the server's country) now include an "Add to Whitelist" button, allowing administrators to immediately resolve potential issues with a single click. * **ENHANCEMENT: Improved Email Templates.** All email notifications, including those for threshold-based blocks (404, 403, login), now use a professional HTML template with the plugin logo and a clear, easy-to-read layout. A "View Blocked IPs" button has also been added for quick access. * **ENHANCEMENT: Full Admin Logging for WP-CLI.** All actions performed via WP-CLI that modify data (blocking, whitelisting, changing settings, etc.) are now correctly recorded in the "General Log", ensuring a complete audit trail. * **TWEAK: Flexible Logo Display.** The plugin's header and email templates now correctly handle both square and rectangular logos without distortion, improving brand customization. * FIX: Addressed a bug where the WP-CLI command `geoblock remove` could fail if the data was not in the expected format. * FIX: Solved a critical error in WP-CLI when running `whitelist add` due to a missing internal function. * FIX: Corrected minor visual bugs in tables and controls on mobile devices, ensuring full interface consistency. = 8.3.3 = * **MAJOR UX/UI OVERHAUL:** The entire admin interface has been redesigned for a more professional, modern, and user-friendly experience. * **ENHANCEMENT: New Plugin Header & Card-Style Layout.** The settings pages now feature a custom header and a clean, organized card-style layout, making navigation clearer and more intuitive. * **ENHANCEMENT: Responsive & Mobile-Friendly Interface.** All plugin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring all features are accessible on any screen. * **ENHANCEMENT: Improved Table Controls.** All data tables now include larger, clearer pagination controls and a new dropdown selector to choose the number of items to display per page. * **ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events. * **TWEAK: Improved Email Templates.** Instant notifications and the welcome/setup guide email now use a professional HTML template with the plugin's logo and direct links. * **TWEAK: Admin Action Logging.** All manual actions performed by an administrator (blocking, whitelisting, clearing logs, etc.) are now recorded in the General Log with the corresponding username for better auditing. * FIX: Addressed an issue where admin notices from other plugins could interfere with the plugin's interface. = 8.3.2 = * **ENHANCEMENT: Major Upgrade to Status & Debug Tab.** The diagnostic tab is now a professional-grade tool. It uses an advanced detection system to accurately identify visitor IPs even behind complex networks like Cloudflare, other CDNs, and proxies. It clearly displays the detection method, the proxy chain, and CDN-specific information (like Ray ID and country), making it an invaluable tool for troubleshooting. * **ENHANCEMENT: Cleaner Admin Interface.** The plugin's admin pages now hide distracting notices from other plugins and WordPress core, providing a much cleaner, focused, and more professional user experience. * **FIX: Removed UI "Flicker".** A visual "flicker" or "jump" of the admin notices that occurred on page load has been completely eliminated, resulting in a smoother and more polished interface. * **TWEAK: Improved Server IP Detection.** The mechanism for auto-detecting the server's own IP address (used for auto-whitelisting) has been made more robust to work reliably across a wider variety of hosting environments. = 8.3.1 = * **UX ENHANCEMENT: Improved Admin Tables.** All data tables (Blocked IPs, Whitelist, Logs, etc.) are now more user-friendly. Pagination controls are larger and clearer, and you can now select the number of items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Responsive Admin Interface.** The entire plugin settings area is now fully responsive. The main tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen. * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **TWEAK: Added Helper Descriptions.** Added descriptive helper texts below the threshold and duration settings to better explain what each option does. * **TWEAK: UI Polish.** Minor visual adjustments to the admin panel header and layout for a cleaner and more professional look. * **FIX:** Fixed an issue where admin notices from other plugins could appear within the plugin's header. The interface is now cleaner and only shows relevant notices. = 8.3.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** A highly requested feature is here! You can now easily block or allow access from entire countries via a user-friendly selector in the Settings tab. The plugin also includes smart warnings to prevent you from accidentally blocking your own server or admin IP address. * **NEW FEATURE: Status & Debug Tab.** A new diagnostic tab has been added to help you and your hosting support troubleshoot IP detection issues, especially on sites behind a CDN or proxy. It shows you exactly what IP the plugin detects for your server and your session. * **NEW FEATURE: Test Email Button.** A new button in the Email Notifications settings allows you to instantly send a test email, helping you verify that your WordPress site's email configuration is working correctly. * **UI ENHANCEMENT: Redesigned Admin Panel.** The entire plugin interface has been updated with a more professional and modern look, including a new header, cleaner tabs, and a "card-style" layout for better organization. * **UX ENHANCEMENT: Improved Table Controls.** All data tables (Blocked IPs, Whitelist, Logs) now feature improved, larger pagination controls and a new dropdown selector to let you choose how many items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **UX ENHANCEMENT: Responsive & Mobile-Friendly.** The plugin's admin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen size. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"), giving you more context. * **ENHANCEMENT: Robust IP Detection.** The logic for detecting both the server's and the visitor's IP address has been significantly improved to be more reliable on complex hosting environments, especially those using CDNs like Cloudflare. * **FIX:** A bug where filtering the "Blocked IPs" list by "404 Error" would not return any results has been resolved. * **FIX:** A critical error in WP-CLI that occurred when adding an IP to the whitelist has been fixed. The CLI is now fully autonomous and synchronized with the admin panel. * **TWEAK:** Added common false-positive URLs (like `/.well-known/traffic-advice` from Google) to the default exclusion list to improve out-of-the-box compatibility. = 8.2.1 = * **Credit tab info update. * **New Spanish translations. = 8.2.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** You can now block access from entire countries via a user-friendly selector in the settings. * **NEW FEATURE: Test Email Button.** A new button in the settings allows you to instantly verify if your WordPress site's email configuration is working correctly. * **ENHANCEMENT: Smart Geoblock Warnings.** The plugin now detects the country of your server and your own admin IP, providing contextual warnings to prevent you from accidentally blocking yourself or your server. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"). * **ENHANCEMENT: WP-CLI.** Added new WP-CLI commands to manage the geoblocking feature (`wp advaipbl geoblock`). The CLI help has been improved for all commands. * **FIX:** Resolved a bug where a filter in the "Blocked IPs" table was not working correctly. * **FIX:** Solved a critical error in WP-CLI when adding an IP to the whitelist. The CLI is now fully autonomous and synchronized. * **TWEAK:** Added `/.well-known/traffic-advice` to the default URL exclusion list to prevent false positives from Google Chrome's prefetch proxy. = 8.1.0 = * **TWEAK:** Performed a full-code refactoring to unify all internal function, class, and option names to the standard `advaipbl` prefix, as requested by the WordPress.org review team. * **TWEAK:** Hardened the plugin to meet WordPress.org guidelines by fixing all reported security (sanitization, escaping, nonces) and internationalization issues. * **FIX:** Resolved a critical bug where WP-CLI commands were not synchronized with the admin dashboard due to inconsistent option names. * **FIX:** Fixed a bug that prevented the "Delete all data on uninstall" feature from working correctly. * **FIX:** Corrected JavaScript errors related to AJAX actions in the User Sessions panel. = 8.0.2 = * Fix: Resolved a bug that could cause a critical error page when a previously blocked user triggered a new type of block (e.g., 404 errors). * Fix: Ensured all text strings throughout the plugin are correctly internationalized and updated the translation template (`.pot`) file. * Fix: Corrected all `ERROR` and major `WARNING` level issues reported by the WordPress.org Plugin Check tool. * Tweak: Improved security by hardening data sanitization and output escaping across all admin pages. * Tweak: Refined WP-CLI command handling to meet strict WordPress coding standards. = 8.0.0 = * Initial public release on the WordPress.org repository. == Upgrade Notice == = 8.1.0 = This is a major stability and standardization update that resolves bugs and brings the plugin into full compliance with WordPress.org guidelines.