=== Advanced IP Blocker === Contributors: inilerm Donate link: https://donate.stripe.com/bJe00kaIP89O1wFfargUM00 Tags: security, firewall, geoblock, , brute force, login security, country block, user agent, honeypot, recaptcha Requires at least: 5.5 Tested up to: 6.8 Stable tag: 8.3.8 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Block IPs by country (Geoblock) or behavior. A lightweight, intelligent firewall with honeypot traps to secure your site. == Description == **Advanced IP Blocker** is your first line of defense against automated bots and malicious actors. Instead of relying on massive, pre-made blocklists, this plugin intelligently blocks IPs based on their real-time actions on *your* site. This provides a lightweight, efficient, and highly effective security layer. **Key Features:** * **Behavioral IP Blocking:** Automatically blocks IPs after a configurable number of 404 (Not Found) or 403 (Forbidden) errors. * **Advanced Login Protection:** Protects against brute-force attacks by blocking IPs after multiple failed login attempts. Includes protection against user enumeration via REST API and author scans. * **NEW: reCAPTCHA v2/v3 Integration:** Protect your login form from bots with Google reCAPTCHA, fully integrated and configurable. Stops automated attacks before they consume server resources. * **Honeypot System:** Instantly blocks IPs that try to access known malicious URLs or "honeypot" traps you define. * **User-Agent Blocking:** Maintain a blocklist of malicious User-Agents to stop bad bots and vulnerability scanners in their tracks. * **Geoblocking (Country Blocking):** Easily block or allow access from specific countries with just a few clicks. * **Active User Session Management:** View all logged-in users in real-time and terminate their sessions remotely if needed. * **Detailed Logging & Auditing:** Every security event, from a failed login to a settings change, is recorded in detailed, easy-to-read logs. * **Full WP-CLI Support:** Every feature, including geoblocking and configuration, is manageable via the command line for power users. * **Professional UI/UX:** A clean, responsive, and intuitive admin interface makes managing your site's security a breeze. This plugin gives you the power to see who is trying to access your site and to stop threats before they become a problem. == Installation == 1. Upload the `advanced-ip-blocker` folder to the `/wp-content/plugins/` directory. 2. Activate the plugin through the 'Plugins' menu in WordPress. 3. Go to `Settings > Advanced IP Blocker` to configure the options. Your administrator IP will be automatically whitelisted on activation. == Recommended Setup == To get the most out of Advanced IP Blocker, we recommend the following initial configuration after installation: 1. **Enable Core Features in the "Settings" Tab:** * Navigate to `Settings > Advanced IP Blocker`. * **Enable Logging:** Check this box to keep a detailed record of all security events. This is crucial for auditing and understanding potential threats. * **Configure Email Notifications:** * Check "Enable Email Notifications" to receive alerts. * Choose your preferred "Notification Frequency" (`Instant` for immediate alerts, or `Daily`/`Weekly` for summaries). * Enter your email address. **Important:** Add this email address to your contacts to prevent notifications from going to spam. * **Review Thresholds:** The default thresholds for 404, 403, and Login errors are a great starting point. You can adjust them later if you find they are too sensitive or not sensitive enough for your site's traffic. 2. **Activate User-Agent Blocking:** * Go to the **"User Agents"** tab. * The plugin provides a list of "Common User-Agent Suggestions to Block". These are well-known scanners, malicious bots, and scrapers. * **Copy** the entire suggested list and **paste** it into the "Blocked User-Agents List" text area. * Click **"Save User-Agent Lists"**. 3. **Activate Honeypot Traps:** * Go to the **"Honeypot URLs"** tab. * Similar to User-Agents, the plugin provides a list of "Common URL Suggestions to Block". These are URLs frequently targeted by bots looking for vulnerabilities. * **Copy** the entire suggested list and **paste** it into the "Honeypot URLs List" text area. * Click **"Save Honeypot URLs"**. That's it! With these three steps, your plugin is now actively configured to block a wide range of common automated attacks, providing a robust layer of security for your website. == External Services == This plugin enhances its functionality by connecting to the following optional, third-party services. These services are only used when their corresponding features are configured and enabled by the administrator. * **Geolocation APIs:** (e.g., ip-api.com, geoiplookup.net, ipinfo.io, etc.) * **Purpose:** To determine the country of a visitor's IP address. This is required for the **Geoblocking** feature and to display location information in the security logs. * **Data Sent:** The visitor's IP address is sent to the selected geolocation service. No other personal data is transmitted. * **Service's Privacy Policy:** Please refer to the privacy policy of the specific geolocation provider you choose in the plugin's settings. * **Google reCAPTCHA API:** * **Purpose:** To protect the WordPress login form from automated bots. * **Data Sent:** When this feature is enabled, user interaction data is sent to Google for analysis. * **Service's Privacy Policy:** Use of this feature is subject to Google's [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms). * **OpenStreetMap:** * **Purpose:** To display interactive maps of IP locations within the plugin's admin area. * **Data Sent:** No user data is sent. The browser loads map tiles directly from OpenStreetMap servers. * **Service's Privacy Policy:** [OpenStreetMap Foundation Privacy Policy](https://wiki.osmfoundation.org/wiki/Privacy_Policy) * **Stripe:** * **Purpose:** To process voluntary donations to support the plugin's development. This is not required for the plugin's functionality. * **Data Sent:** If you choose to donate, you will be redirected to Stripe's secure payment page. * **Service's Privacy Policy:** [Stripe Privacy Policy](https://stripe.com/privacy) == Frequently Asked Questions == = Does this plugin slow down my website? = No. The plugin is designed to be extremely lightweight. Most of the intensive operations happen in the WordPress admin area. For regular visitors, the checks are based on highly efficient WordPress transients (cached data), resulting in a negligible impact on page load times. = How does Country Blocking (Geoblocking) work? = This feature allows you to block all visitors from specific countries you select. It uses an external geolocation service (configurable in the settings) to determine the visitor's country based on their IP address. To be highly efficient, the plugin only checks the country for new, unknown IPs. Once an IP from a blocked country is identified, it is added to a permanent block list, so no further API calls are needed for that IP. **Important:** Be careful not to block the country where your server is located, as this can interfere with your site's internal functions (like cron jobs). The plugin will warn you if you attempt to do this. = What is a "Honeypot"? = A honeypot is a trap for bots. Bots often scan for specific files or URLs that are known vulnerabilities (e.g., `wp-config.php`). By adding these to the Honeypot list, you can instantly block any bot that tries to access them, as no legitimate user would ever request those URLs. = Which Geolocation Provider should I use? = For most users, **geoiplookup.net** is the recommended choice as it's free and uses a secure (HTTPS) connection without requiring an API key. If you need higher request limits, consider getting a free or paid key for one of the other supported services. = Can I manage the plugin without logging into WordPress? = Yes! The plugin has full WP-CLI support. You can block/unblock IPs, manage whitelists, view logs, and change settings directly from your server's command line. Run `wp help advaipbl` for a full list of commands. = What is "Whitelist Login Access" and when should I use it? = This is a very powerful security feature found in the "Failed Login Blocking" section of the settings. When enabled, it completely blocks access to the WordPress login page (`wp-login.php`) for **every IP address that is NOT on your whitelist**. **This will stop 100% of brute-force login attacks.** However, you should use it with extreme caution: * **DO NOT USE** this feature if you have a public website where users need to register or log in (e.g., WooCommerce stores, membership sites, forums). It will block your customers. * **ONLY USE** this feature on private sites where only a few administrators with known, static IP addresses need to log in. * **ALWAYS** ensure your own IP address and your server's IP address are on the whitelist before enabling this feature. The plugin will warn you if they are not. If you get locked out, you will need to use WP-CLI to disable this feature or add your IP to the whitelist. = How do I enable reCAPTCHA protection? = 1. First, you need to get reCAPTCHA keys (v2 Checkbox or v3) from the [Google reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create). Make sure you register your domain correctly (e.g., `yourdomain.com` and `www.yourdomain.com`). 2. In your WordPress admin, go to "Settings" > "Advanced IP Blocker". 3. On the "Settings" tab, scroll down to the "reCAPTCHA Protection" card. 4. Check the "Enable reCAPTCHA" box. 5. Select the correct version (v2 or v3) that matches the keys you generated. 6. Copy and paste your "Site Key" and "Secret Key" into the corresponding fields. 7. Click "Save Changes". The reCAPTCHA will now appear on your `wp-login.php` page. == Screenshots == 1. The main Settings page where you configure general options and thresholds. 2. The advanced Blocked IPs table with filtering, sorting, and pagination. 3. User-Agent management with both block and whitelist capabilities. 4. The User Sessions dashboard to monitor and terminate active sessions. 5. The Honeypot URLs configuration screen. 6. The IP Whitelist management tab. 7. Example of the 404 Error Log table. 8. Example of the 403 Error Log table. 9. The General Log for auditing all plugin actions. 10. The Credits tab showing plugin information. 11. WP-CLI commands list available for developers. 12. An example of an instant email notification. 13. Country Blocking (Geoblocking) == Changelog == = 8.3.8 = * New: Added Google reCAPTCHA (v2 "I'm not a robot" and v3 Invisible) protection for the WordPress login form to combat automated bot attacks. * New: Added a dedicated "reCAPTCHA Protection" section in the "Settings" tab to configure keys, version, and v3 score threshold. * Tweak: All reCAPTCHA settings are now fully manageable via the `wp advaipbl config get/set` WP-CLI commands. * Tweak: Added detailed audit logs for any changes made to reCAPTCHA settings, including activation, deactivation, and key updates. * Tweak: Updated the "Credits" page to reflect new features and attributions, and added a new "External Services" section to the readme for transparency. = 8.3.7 = * **NEW SECURITY FEATURE: Whitelist-Only Login.** A new, highly-secure option has been added to completely restrict access to the `wp-login.php` page, allowing only IPs from the whitelist. This provides a powerful defense against all brute-force attacks. * **NEW SECURITY FEATURE: User Enumeration Protection.** Added two new options (enabled by default) to prevent bots from discovering usernames via REST API endpoints and author archive scanning (`?author=1`), significantly hardening your site against targeted attacks. * **ENHANCEMENT:** All email notifications (including for threshold-based blocks) now use a professional HTML template with the plugin logo and a "View Blocked IPs" button for better user experience. * **FIX:** Resolved an issue where the new "Login Failure Log" tab was not being displayed correctly. It is now fully functional and shows detailed information, including the attempted username. * **FIX:** Corrected a bug in WP-CLI that caused warnings or errors when managing the geoblock list and other settings. All WP-CLI commands are now fully functional and log their actions. = 8.3.6 = * FIX: Buttons to save changes in the configuration tab * Tweak: Updated Spanish translations. * Tweak: Updated internal image assets for a refreshed look. = 8.3.5 = * Tweak: Updated internal image assets for a refreshed look. = 8.3.4 = * **NEW FEATURE: Login Failure Log Tab.** A new dedicated "Login Log" tab has been added to the admin panel, allowing administrators to easily view all failed login attempts, including the IP address and the username that was attempted. This completes the set of security logs, providing full visibility into all types of automated attacks. * **ENHANCEMENT: Interactive Admin Notices.** The contextual warnings (e.g., when blocking the server's country) now include an "Add to Whitelist" button, allowing administrators to immediately resolve potential issues with a single click. * **ENHANCEMENT: Improved Email Templates.** All email notifications, including those for threshold-based blocks (404, 403, login), now use a professional HTML template with the plugin logo and a clear, easy-to-read layout. A "View Blocked IPs" button has also been added for quick access. * **ENHANCEMENT: Full Admin Logging for WP-CLI.** All actions performed via WP-CLI that modify data (blocking, whitelisting, changing settings, etc.) are now correctly recorded in the "General Log", ensuring a complete audit trail. * **TWEAK: Flexible Logo Display.** The plugin's header and email templates now correctly handle both square and rectangular logos without distortion, improving brand customization. * FIX: Addressed a bug where the WP-CLI command `geoblock remove` could fail if the data was not in the expected format. * FIX: Solved a critical error in WP-CLI when running `whitelist add` due to a missing internal function. * FIX: Corrected minor visual bugs in tables and controls on mobile devices, ensuring full interface consistency. = 8.3.3 = * **MAJOR UX/UI OVERHAUL:** The entire admin interface has been redesigned for a more professional, modern, and user-friendly experience. * **ENHANCEMENT: New Plugin Header & Card-Style Layout.** The settings pages now feature a custom header and a clean, organized card-style layout, making navigation clearer and more intuitive. * **ENHANCEMENT: Responsive & Mobile-Friendly Interface.** All plugin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring all features are accessible on any screen. * **ENHANCEMENT: Improved Table Controls.** All data tables now include larger, clearer pagination controls and a new dropdown selector to choose the number of items to display per page. * **ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events. * **TWEAK: Improved Email Templates.** Instant notifications and the welcome/setup guide email now use a professional HTML template with the plugin's logo and direct links. * **TWEAK: Admin Action Logging.** All manual actions performed by an administrator (blocking, whitelisting, clearing logs, etc.) are now recorded in the General Log with the corresponding username for better auditing. * FIX: Addressed an issue where admin notices from other plugins could interfere with the plugin's interface. = 8.3.2 = * **ENHANCEMENT: Major Upgrade to Status & Debug Tab.** The diagnostic tab is now a professional-grade tool. It uses an advanced detection system to accurately identify visitor IPs even behind complex networks like Cloudflare, other CDNs, and proxies. It clearly displays the detection method, the proxy chain, and CDN-specific information (like Ray ID and country), making it an invaluable tool for troubleshooting. * **ENHANCEMENT: Cleaner Admin Interface.** The plugin's admin pages now hide distracting notices from other plugins and WordPress core, providing a much cleaner, focused, and more professional user experience. * **FIX: Removed UI "Flicker".** A visual "flicker" or "jump" of the admin notices that occurred on page load has been completely eliminated, resulting in a smoother and more polished interface. * **TWEAK: Improved Server IP Detection.** The mechanism for auto-detecting the server's own IP address (used for auto-whitelisting) has been made more robust to work reliably across a wider variety of hosting environments. = 8.3.1 = * **UX ENHANCEMENT: Improved Admin Tables.** All data tables (Blocked IPs, Whitelist, Logs, etc.) are now more user-friendly. Pagination controls are larger and clearer, and you can now select the number of items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Responsive Admin Interface.** The entire plugin settings area is now fully responsive. The main tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen. * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **TWEAK: Added Helper Descriptions.** Added descriptive helper texts below the threshold and duration settings to better explain what each option does. * **TWEAK: UI Polish.** Minor visual adjustments to the admin panel header and layout for a cleaner and more professional look. * **FIX:** Fixed an issue where admin notices from other plugins could appear within the plugin's header. The interface is now cleaner and only shows relevant notices. = 8.3.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** A highly requested feature is here! You can now easily block or allow access from entire countries via a user-friendly selector in the Settings tab. The plugin also includes smart warnings to prevent you from accidentally blocking your own server or admin IP address. * **NEW FEATURE: Status & Debug Tab.** A new diagnostic tab has been added to help you and your hosting support troubleshoot IP detection issues, especially on sites behind a CDN or proxy. It shows you exactly what IP the plugin detects for your server and your session. * **NEW FEATURE: Test Email Button.** A new button in the Email Notifications settings allows you to instantly send a test email, helping you verify that your WordPress site's email configuration is working correctly. * **UI ENHANCEMENT: Redesigned Admin Panel.** The entire plugin interface has been updated with a more professional and modern look, including a new header, cleaner tabs, and a "card-style" layout for better organization. * **UX ENHANCEMENT: Improved Table Controls.** All data tables (Blocked IPs, Whitelist, Logs) now feature improved, larger pagination controls and a new dropdown selector to let you choose how many items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **UX ENHANCEMENT: Responsive & Mobile-Friendly.** The plugin's admin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen size. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"), giving you more context. * **ENHANCEMENT: Robust IP Detection.** The logic for detecting both the server's and the visitor's IP address has been significantly improved to be more reliable on complex hosting environments, especially those using CDNs like Cloudflare. * **FIX:** A bug where filtering the "Blocked IPs" list by "404 Error" would not return any results has been resolved. * **FIX:** A critical error in WP-CLI that occurred when adding an IP to the whitelist has been fixed. The CLI is now fully autonomous and synchronized with the admin panel. * **TWEAK:** Added common false-positive URLs (like `/.well-known/traffic-advice` from Google) to the default exclusion list to improve out-of-the-box compatibility. = 8.2.1 = * **Credit tab info update. * **New Spanish translations. = 8.2.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** You can now block access from entire countries via a user-friendly selector in the settings. * **NEW FEATURE: Test Email Button.** A new button in the settings allows you to instantly verify if your WordPress site's email configuration is working correctly. * **ENHANCEMENT: Smart Geoblock Warnings.** The plugin now detects the country of your server and your own admin IP, providing contextual warnings to prevent you from accidentally blocking yourself or your server. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"). * **ENHANCEMENT: WP-CLI.** Added new WP-CLI commands to manage the geoblocking feature (`wp advaipbl geoblock`). The CLI help has been improved for all commands. * **FIX:** Resolved a bug where a filter in the "Blocked IPs" table was not working correctly. * **FIX:** Solved a critical error in WP-CLI when adding an IP to the whitelist. The CLI is now fully autonomous and synchronized. * **TWEAK:** Added `/.well-known/traffic-advice` to the default URL exclusion list to prevent false positives from Google Chrome's prefetch proxy. = 8.1.0 = * **TWEAK:** Performed a full-code refactoring to unify all internal function, class, and option names to the standard `advaipbl` prefix, as requested by the WordPress.org review team. * **TWEAK:** Hardened the plugin to meet WordPress.org guidelines by fixing all reported security (sanitization, escaping, nonces) and internationalization issues. * **FIX:** Resolved a critical bug where WP-CLI commands were not synchronized with the admin dashboard due to inconsistent option names. * **FIX:** Fixed a bug that prevented the "Delete all data on uninstall" feature from working correctly. * **FIX:** Corrected JavaScript errors related to AJAX actions in the User Sessions panel. = 8.0.2 = * Fix: Resolved a bug that could cause a critical error page when a previously blocked user triggered a new type of block (e.g., 404 errors). * Fix: Ensured all text strings throughout the plugin are correctly internationalized and updated the translation template (`.pot`) file. * Fix: Corrected all `ERROR` and major `WARNING` level issues reported by the WordPress.org Plugin Check tool. * Tweak: Improved security by hardening data sanitization and output escaping across all admin pages. * Tweak: Refined WP-CLI command handling to meet strict WordPress coding standards. = 8.0.0 = * Initial public release on the WordPress.org repository. == Upgrade Notice == = 8.1.0 = This is a major stability and standardization update that resolves bugs and brings the plugin into full compliance with WordPress.org guidelines.