=== Advanced IP Blocker === Contributors: inilerm Donate link: https://donate.stripe.com/bJe00kaIP89O1wFfargUM00 Tags: security, firewall, ip blocker, block ip, brute force, country block Requires at least: 5.8 Tested up to: 6.8 Stable tag: 8.3.9 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html A powerful and user-friendly security plugin to protect your WordPress site by blocking malicious IPs, IP ranges, countries, and bots. == Description == **Advanced IP Blocker** is your all-in-one security solution to safeguard your WordPress website from a wide range of threats. This plugin provides a comprehensive suite of tools to automatically detect and block malicious activity, including brute-force attacks, vulnerability scanning, and spam bots. With its intuitive interface, you can easily manage whitelists, blocklists, and view detailed security logs to understand exactly how your site is being protected. Whether you're a beginner or an experienced administrator, Advanced IP Blocker gives you the control you need to secure your digital presence. **Key Features:** * **Intelligent IP & Range Blocking:** Automatically block IPs and CIDR ranges based on configurable thresholds for 404 errors, 403 errors, and failed login attempts. * **Comprehensive Login Protection:** Secure your login page by disabling the XML-RPC interface, preventing user enumeration via the REST API and author scans, and restricting `wp-login.php` access to whitelisted IPs only. * **Google reCAPTCHA Integration:** Shield your login and registration forms from bots by integrating Google reCAPTCHA (v2 & v3). * **Country Blocking (Geoblocking):** Easily block traffic from entire countries with a user-friendly selector and real-time API key verification. * **Honeypot Traps:** Instantly ban bots and scanners that access decoy URLs, a highly effective method against automated attacks. * **Malicious User-Agent Blocking:** Maintain and use a custom list of malicious User-Agent strings to block known bad bots instantly. * **Active User Session Management:** View all logged-in users in real-time, see their location, and terminate their sessions remotely with a single click. * **Full WP-CLI Support:** Manage every aspect of the plugin via the command line, ideal for developers and system administrators. * **Configuration Management:** Easily back up and migrate your complete plugin configuration with the new Import/Export feature. * **Detailed Event Logging:** Keep track of all security events with detailed, sortable, and filterable logs. This plugin gives you the power to see who is trying to access your site and to stop threats before they become a problem. == Installation == 1. Upload the `advanced-ip-blocker` folder to the `/wp-content/plugins/` directory. 2. Activate the plugin through the 'Plugins' menu in WordPress. 3. Go to `Settings > Advanced IP Blocker` to configure the plugin. 4. It is highly recommended to review the `Status & Debug` tab to ensure your IP and your server's IP are whitelisted to prevent accidental lockouts. == Recommended Setup == For optimal protection with minimal configuration, follow these steps after installation: 1. **Whitelist Your IPs:** Go to the `Status & Debug` tab and use the one-click buttons to add your current IP and your server's IP to the whitelist. This is the most important step. 2. **Activate Core Defenses:** Go to the **"User Agents"** tab, copy the suggested list of malicious bots, and paste it into the "Blocked User-Agents List" text area. Then, go to the **"Honeypot URLs"** tab and do the same. Click "Save" on each page. 3. **Review Login Protection:** Navigate to `Settings` and scroll to the "Failed Login Blocking" section. Ensure that `Disable User Enumeration via REST API` and `Prevent user enumeration via author scans` are checked. For maximum security, also check `Disable XML-RPC`, but read the FAQ first if you use Jetpack or the mobile app. 4. **Enable Notifications:** In the `Email Notifications` section, enable notifications to receive alerts or daily/weekly security summaries. That's it! Your plugin is now actively configured to block a wide range of common automated attacks, providing a robust layer of security for your website. == External Services == This plugin enhances its functionality by connecting to the following optional, third-party services. These services are only used when their corresponding features are configured and enabled by the administrator. * **Geolocation APIs:** (e.g., ip-api.com, geoiplookup.net, ipinfo.io, etc.) * **Purpose:** To determine the country of a visitor's IP address. This is required for the **Geoblocking** feature and to display location information in the security logs. * **Data Sent:** The visitor's IP address is sent to the selected geolocation service. No other personal data is transmitted. * **Service's Privacy Policy:** Please refer to the privacy policy of the specific geolocation provider you choose in the plugin's settings. * **Google reCAPTCHA API:** * **Purpose:** To protect the WordPress login form from automated bots. * **Data Sent:** When this feature is enabled, user interaction data is sent to Google for analysis. * **Service's Privacy Policy:** Use of this feature is subject to Google's [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms). * **OpenStreetMap:** * **Purpose:** To display interactive maps of IP locations within the plugin's admin area. * **Data Sent:** No user data is sent. The browser loads map tiles directly from OpenStreetMap servers. * **Service's Privacy Policy:** [OpenStreetMap Foundation Privacy Policy](https://wiki.osmfoundation.org/wiki/Privacy_Policy) * **Stripe:** * **Purpose:** To process voluntary donations to support the plugin's development. This is not required for the plugin's functionality. * **Data Sent:** If you choose to donate, you will be redirected to Stripe's secure payment page. * **Service's Privacy Policy:** [Stripe Privacy Policy](https://stripe.com/privacy) == Frequently Asked Questions == = Does this plugin slow down my website? = No. The plugin is designed to be extremely lightweight. For regular visitors, security checks are based on highly efficient WordPress transients (cached data), resulting in a negligible impact on page load times. More intensive operations, like cleaning expired IPs, only happen when you visit specific admin pages. = How does Country Blocking (Geoblocking) work? = This feature allows you to block all visitors from specific countries. It uses an external geolocation service to determine a visitor's country from their IP address. To be highly efficient, the plugin only checks the country for new IPs. Once an IP from a blocked country is identified, it is added to a block list, so no further API calls are needed for that IP. **Important:** Be careful not to block the country where your server is located, as this can interfere with your site's internal functions (like cron jobs). The plugin will warn you if you attempt to do this. = What is a "Honeypot"? = A honeypot is a trap for bots. Bots often scan for specific files or URLs that indicate known vulnerabilities (e.g., `wp-config.php`). By adding these to the Honeypot list, you can instantly block any bot that tries to access them, as no legitimate user would ever request those URLs. = Which Geolocation Provider should I use? = For most users, **geoiplookup.net** (the default) is the recommended choice as it's free and uses a secure (HTTPS) connection without requiring an API key. If you need higher request limits, you can get an API key for one of the other supported services and verify it directly in the plugin settings. = Can I manage the plugin without logging into WordPress? = Yes! The plugin has full WP-CLI support. You can block/unblock IPs and ranges, manage whitelists, view logs, and change settings directly from your server's command line. Run `wp help advaipbl` for a full list of commands. = What is "Whitelist Login Access" and when should I use it? = This is a very powerful security feature that completely blocks access to the WordPress login page (`wp-login.php`) for **every IP address that is NOT on your whitelist**. This will stop 100% of brute-force login attacks. However, you should use it with extreme caution: * **DO NOT USE** this feature if you have a public website where users need to register or log in (e.g., WooCommerce stores, membership sites). * **ONLY USE** this feature on private sites where only a few administrators with known, static IP addresses need to log in. * **ALWAYS** ensure your own IP address is on the whitelist before enabling this feature. = What is XML-RPC and should I disable it? = XML-RPC is a legacy interface that allows remote connections to your site. It is a primary target for brute-force attacks. **We highly recommend disabling it** unless you specifically use services that require it, such as the Jetpack app or some remote publishing tools. If you must leave it enabled, ensure your "Failed Login" threshold is set to a low number (e.g., 3). = Can "Disable User Enumeration" break my site? = It is extremely unlikely. This feature blocks unauthenticated access to the REST API endpoint that lists usernames. Legitimate plugins and themes almost never need to access this list publicly. The security benefit greatly outweighs the minimal risk. = How does the Import/Export feature work? = This feature allows you to download a `.json` file of your plugin's configuration. * **Export Template (No API Keys):** Safe to use as a starting point for other websites. * **Export Full Backup (With API Keys):** Creates a complete backup for restoring on the **same site**. The `Import` function will overwrite your current settings. It is a secure process that only imports known plugin options. = How do I enable reCAPTCHA protection? = 1. Get reCAPTCHA keys from the [Google reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create). 2. Go to `Settings > Advanced IP Blocker`. 3. In the "reCAPTCHA Protection" card, check "Enable reCAPTCHA". 4. Select the correct version (v2 or v3) and paste your Site Key and Secret Key. 5. Click "Save Changes". == Screenshots == 1. The main Settings page where you configure general options and thresholds. 2. The advanced Blocked IPs table with filtering, sorting, and pagination. 3. User-Agent management with both block and whitelist capabilities. 4. The User Sessions dashboard to monitor and terminate active sessions. 5. The Honeypot URLs configuration screen. 6. The IP Whitelist management tab. 7. Example of the 404 Error Log table. 8. Example of the 403 Error Log table. 9. The General Log for auditing all plugin actions. 10. The Credits tab showing plugin information. 11. WP-CLI commands list available for developers. 12. An example of an instant email notification. 13. Country Blocking (Geoblocking) == Changelog == = 8.3.9 = * **New Feature:** Full configuration Import/Export for easy backups and migration. * **New Feature:** Real-time AJAX verification for Geolocation API keys. * **Enhancement:** Added full support for blocking and whitelisting CIDR and IP ranges. * **Enhancement:** All log tables now display parsed device and OS information for easier identification. * **Enhancement:** Greatly improved WP-CLI command documentation and added a new `provider` command for Geolocation APIs. * **Enhancement:** Optimized admin performance by using a "just-in-time" cleanup for expired IPs. * **Fix:** Resolved a critical bug where incorrect details were saved for threshold-based blocks. * **Fix:** Fixed multiple bugs in WP-CLI related to Geoblocking and option handling. * **Fix:** Corrected an issue where settings were not being saved correctly due to a form conflict. * **Fix:** Resolved data not being fully removed on uninstall when the option was selected. = 8.3.8 = * New: Added Google reCAPTCHA (v2 & v3) protection for the WordPress login form. * Tweak: All settings are now fully manageable via WP-CLI. * Tweak: Added detailed audit logs for any changes made to reCAPTCHA settings. = 8.3.7 = * **NEW SECURITY FEATURE: Whitelist-Only Login.** Added a highly-secure option to restrict `wp-login.php` access to whitelisted IPs. * **NEW SECURITY FEATURE: User Enumeration Protection.** Added options to prevent username discovery via REST API and author scans. * **ENHANCEMENT:** All email notifications now use a professional HTML template. = 8.3.6 = * FIX: Buttons to save changes in the configuration tab * Tweak: Updated Spanish translations. * Tweak: Updated internal image assets for a refreshed look. = 8.3.5 = * Tweak: Updated internal image assets for a refreshed look. = 8.3.4 = * **NEW FEATURE: Login Failure Log Tab.** A new dedicated "Login Log" tab has been added to the admin panel, allowing administrators to easily view all failed login attempts, including the IP address and the username that was attempted. This completes the set of security logs, providing full visibility into all types of automated attacks. * **ENHANCEMENT: Interactive Admin Notices.** The contextual warnings (e.g., when blocking the server's country) now include an "Add to Whitelist" button, allowing administrators to immediately resolve potential issues with a single click. * **ENHANCEMENT: Improved Email Templates.** All email notifications, including those for threshold-based blocks (404, 403, login), now use a professional HTML template with the plugin logo and a clear, easy-to-read layout. A "View Blocked IPs" button has also been added for quick access. * **ENHANCEMENT: Full Admin Logging for WP-CLI.** All actions performed via WP-CLI that modify data (blocking, whitelisting, changing settings, etc.) are now correctly recorded in the "General Log", ensuring a complete audit trail. * **TWEAK: Flexible Logo Display.** The plugin's header and email templates now correctly handle both square and rectangular logos without distortion, improving brand customization. * FIX: Addressed a bug where the WP-CLI command `geoblock remove` could fail if the data was not in the expected format. * FIX: Solved a critical error in WP-CLI when running `whitelist add` due to a missing internal function. * FIX: Corrected minor visual bugs in tables and controls on mobile devices, ensuring full interface consistency. = 8.3.3 = * **MAJOR UX/UI OVERHAUL:** The entire admin interface has been redesigned for a more professional, modern, and user-friendly experience. * **ENHANCEMENT: New Plugin Header & Card-Style Layout.** The settings pages now feature a custom header and a clean, organized card-style layout, making navigation clearer and more intuitive. * **ENHANCEMENT: Responsive & Mobile-Friendly Interface.** All plugin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring all features are accessible on any screen. * **ENHANCEMENT: Improved Table Controls.** All data tables now include larger, clearer pagination controls and a new dropdown selector to choose the number of items to display per page. * **ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events. * **TWEAK: Improved Email Templates.** Instant notifications and the welcome/setup guide email now use a professional HTML template with the plugin's logo and direct links. * **TWEAK: Admin Action Logging.** All manual actions performed by an administrator (blocking, whitelisting, clearing logs, etc.) are now recorded in the General Log with the corresponding username for better auditing. * FIX: Addressed an issue where admin notices from other plugins could interfere with the plugin's interface. = 8.3.2 = * **ENHANCEMENT: Major Upgrade to Status & Debug Tab.** The diagnostic tab is now a professional-grade tool. It uses an advanced detection system to accurately identify visitor IPs even behind complex networks like Cloudflare, other CDNs, and proxies. It clearly displays the detection method, the proxy chain, and CDN-specific information (like Ray ID and country), making it an invaluable tool for troubleshooting. * **ENHANCEMENT: Cleaner Admin Interface.** The plugin's admin pages now hide distracting notices from other plugins and WordPress core, providing a much cleaner, focused, and more professional user experience. * **FIX: Removed UI "Flicker".** A visual "flicker" or "jump" of the admin notices that occurred on page load has been completely eliminated, resulting in a smoother and more polished interface. * **TWEAK: Improved Server IP Detection.** The mechanism for auto-detecting the server's own IP address (used for auto-whitelisting) has been made more robust to work reliably across a wider variety of hosting environments. = 8.3.1 = * **UX ENHANCEMENT: Improved Admin Tables.** All data tables (Blocked IPs, Whitelist, Logs, etc.) are now more user-friendly. Pagination controls are larger and clearer, and you can now select the number of items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Responsive Admin Interface.** The entire plugin settings area is now fully responsive. The main tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen. * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **TWEAK: Added Helper Descriptions.** Added descriptive helper texts below the threshold and duration settings to better explain what each option does. * **TWEAK: UI Polish.** Minor visual adjustments to the admin panel header and layout for a cleaner and more professional look. * **FIX:** Fixed an issue where admin notices from other plugins could appear within the plugin's header. The interface is now cleaner and only shows relevant notices. = 8.3.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** A highly requested feature is here! You can now easily block or allow access from entire countries via a user-friendly selector in the Settings tab. The plugin also includes smart warnings to prevent you from accidentally blocking your own server or admin IP address. * **NEW FEATURE: Status & Debug Tab.** A new diagnostic tab has been added to help you and your hosting support troubleshoot IP detection issues, especially on sites behind a CDN or proxy. It shows you exactly what IP the plugin detects for your server and your session. * **NEW FEATURE: Test Email Button.** A new button in the Email Notifications settings allows you to instantly send a test email, helping you verify that your WordPress site's email configuration is working correctly. * **UI ENHANCEMENT: Redesigned Admin Panel.** The entire plugin interface has been updated with a more professional and modern look, including a new header, cleaner tabs, and a "card-style" layout for better organization. * **UX ENHANCEMENT: Improved Table Controls.** All data tables (Blocked IPs, Whitelist, Logs) now feature improved, larger pagination controls and a new dropdown selector to let you choose how many items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **UX ENHANCEMENT: Responsive & Mobile-Friendly.** The plugin's admin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen size. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"), giving you more context. * **ENHANCEMENT: Robust IP Detection.** The logic for detecting both the server's and the visitor's IP address has been significantly improved to be more reliable on complex hosting environments, especially those using CDNs like Cloudflare. * **FIX:** A bug where filtering the "Blocked IPs" list by "404 Error" would not return any results has been resolved. * **FIX:** A critical error in WP-CLI that occurred when adding an IP to the whitelist has been fixed. The CLI is now fully autonomous and synchronized with the admin panel. * **TWEAK:** Added common false-positive URLs (like `/.well-known/traffic-advice` from Google) to the default exclusion list to improve out-of-the-box compatibility. = 8.2.1 = * **Credit tab info update. * **New Spanish translations. = 8.2.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** You can now block access from entire countries via a user-friendly selector in the settings. * **NEW FEATURE: Test Email Button.** A new button in the settings allows you to instantly verify if your WordPress site's email configuration is working correctly. * **ENHANCEMENT: Smart Geoblock Warnings.** The plugin now detects the country of your server and your own admin IP, providing contextual warnings to prevent you from accidentally blocking yourself or your server. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"). * **ENHANCEMENT: WP-CLI.** Added new WP-CLI commands to manage the geoblocking feature (`wp advaipbl geoblock`). The CLI help has been improved for all commands. * **FIX:** Resolved a bug where a filter in the "Blocked IPs" table was not working correctly. * **FIX:** Solved a critical error in WP-CLI when adding an IP to the whitelist. The CLI is now fully autonomous and synchronized. * **TWEAK:** Added `/.well-known/traffic-advice` to the default URL exclusion list to prevent false positives from Google Chrome's prefetch proxy. = 8.1.0 = * **TWEAK:** Performed a full-code refactoring to unify all internal function, class, and option names to the standard `advaipbl` prefix, as requested by the WordPress.org review team. * **TWEAK:** Hardened the plugin to meet WordPress.org guidelines by fixing all reported security (sanitization, escaping, nonces) and internationalization issues. * **FIX:** Resolved a critical bug where WP-CLI commands were not synchronized with the admin dashboard due to inconsistent option names. * **FIX:** Fixed a bug that prevented the "Delete all data on uninstall" feature from working correctly. * **FIX:** Corrected JavaScript errors related to AJAX actions in the User Sessions panel. = 8.0.2 = * Fix: Resolved a bug that could cause a critical error page when a previously blocked user triggered a new type of block (e.g., 404 errors). * Fix: Ensured all text strings throughout the plugin are correctly internationalized and updated the translation template (`.pot`) file. * Fix: Corrected all `ERROR` and major `WARNING` level issues reported by the WordPress.org Plugin Check tool. * Tweak: Improved security by hardening data sanitization and output escaping across all admin pages. * Tweak: Refined WP-CLI command handling to meet strict WordPress coding standards. = 8.0.0 = * Initial public release on the WordPress.org repository. == Upgrade Notice == = 8.3.9 = This is a major feature and stability release. It is highly recommended to update. This version introduces IP range blocking, a full Import/Export system, and fixes several important bugs related to logging and WP-CLI. Please back up your settings before upgrading.