=== Advanced IP Blocker === Contributors: inilerm Author URI: https://advaipbl.com/ Donate link: https://donate.stripe.com/bJe00kaIP89O1wFfargUM00 Tags: security, firewall, waf, ip blocker, country block, brute force, block ip, rate limit Requires at least: 5.8 Tested up to: 6.8.2 Stable tag: 8.4.4.3 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html A powerful and user-friendly security plugin with a Web Application Firewall (WAF) to protect your WordPress site by blocking malicious IPs, IP ranges, countries, and bots. == Description == **Advanced IP Blocker** is your all-in-one security solution to safeguard your WordPress website from a wide range of threats. This plugin provides a comprehensive suite of tools to automatically detect and block malicious activity, including brute-force attacks, vulnerability scanning, and spam bots. With its intuitive and newly redesigned interface, you can easily manage whitelists, blocklists, and view detailed security logs to understand exactly how your site is being protected. Whether you're a beginner or an experienced administrator, Advanced IP Blocker gives you the control you need to secure your digital presence. **Key Features:** * **Security Dashboard:** Get a real-time, visual overview of threats with interactive charts for attack summaries, a threat timeline, and a live, clustered attack map. * **Web Application Firewall (WAF):** Proactively block malicious requests (SQLi, XSS, LFI) with a customizable ruleset and a URL exclusion system to ensure compatibility with payment gateways. * **Request Rate Limiting:** Automatically prevent DoS attacks and brute-force attempts by temporarily blocking IPs that make too many requests. * **Granular ASN Blocking:** Block entire networks by blacklisting Autonomous System Numbers (ASN). Now with separate controls for the automated Spamhaus DROP list and your own manual blocklist. * **Country Blocking (Geoblocking):** Easily block traffic from entire countries with a user-friendly selector and smart warnings to prevent lockouts. * **Threshold-Based Blocking:** Automatically block IPs based on configurable thresholds for 404 errors, 403 errors, and failed login attempts. * **Advanced Login Protection:** Harden your login page with **intelligent "Smart" XML-RPC protection that verifies traffic from Automattic's official network (ASN verification)**. Also includes options to disable user enumeration and restrict access to whitelisted IPs only. * **Push Notifications (Webhooks):** Receive instant, detailed security alerts on modern platforms like Slack and Discord, keeping you informed of critical events in real-time. * **Google reCAPTCHA Integration:** Shield your login and registration forms from bots by integrating Google reCAPTCHA (v2 & v3). * **Honeypot & User-Agent Traps:** Instantly ban bots and scanners that access decoy URLs or use malicious User-Agent strings. * **Live Security Feed Shortcode:** Display a real-time, terminal-style feed of block events on any page or post using the `[advaipbl_live_feed]` shortcode. * **Active User Session Management:** View all logged-in users in real-time, see their location, and terminate their sessions remotely. * **Full WP-CLI Support:** Manage every aspect of the plugin via the command line, ideal for developers and system administrators. * **Detailed Event Logging:** Track all security events with detailed, sortable, and filterable logs. Now with even more context, like the source of an ASN block and the URI of the attack. This plugin gives you the power to see who is trying to access your site and to stop threats before they become a problem. == Installation == 1. Upload the `advanced-ip-blocker` folder to the `/wp-content/plugins/` directory. 2. Activate the plugin through the 'Plugins' menu in WordPress. 3. A new **"Security"** menu item with a shield icon will appear in your admin sidebar. All settings are located there. 4. It is highly recommended to visit the `Settings > Status & Debug` tab to ensure your IP and your server's IP are whitelisted. == Recommended Setup == For optimal protection, follow these steps after installation: 1. **Navigate to the Plugin:** Find the new **"Security"** menu item in your WordPress admin menu. 2. **Whitelist Your IPs:** Go to `Settings > Status & Debug` and use the one-click buttons to add your current IP and your server's IP to the whitelist. This is the most important step to prevent accidental lockouts. 3. **Activate Core Defenses:** Go to `Blocking Rules > User Agents`, copy the suggested list of malicious bots, and paste it into the blocklist. Then, go to `Blocking Rules > Honeypot URLs` and do the same. Click "Save" on each page. 4. **Enable WAF & Rate Limiting:** Go to `Settings > General` and enable the "Web Application Firewall" and "Request Rate Limiting" options for proactive protection. 5. **Review Login Protection:** Navigate to `Settings > General`. We recommend keeping `Disable User Enumeration` and `Prevent author scans` enabled. Also, consider enabling `Disable XML-RPC` for maximum security (read the FAQ first if you use Jetpack or the mobile app). 6. **Enable Notifications:** In the `Email Notifications` section on the `Settings` tab, enable notifications to receive alerts or daily/weekly security summaries. That's it! Your plugin is now actively configured to block a wide range of common automated attacks. == Frequently Asked Questions == = I can't find the plugin's settings! = After activation, the plugin adds a main menu item named **"Security"** (with a shield icon) to your WordPress admin sidebar. All features are now organized into logical parent tabs: **Dashboard, Settings, Blocking Rules, IP Management, Logs & Sessions, and About**. = What does the new Security Dashboard show? = The dashboard provides a real-time overview of your site's security. It includes interactive charts showing the volume and types of attacks over the last 7 days, as well as lists of the top attacking IPs and countries. It's the best way to see the plugin working to protect your site. = What is a Web Application Firewall (WAF)? = The WAF is a proactive security layer. It inspects incoming web traffic for malicious patterns (like SQL injection or cross-site scripting) and blocks the request before it can reach WordPress, protecting you from vulnerabilities in other plugins or themes. You can add your own custom rules in the `Blocking Rules > Firewall (WAF)` tab. = What is Rate Limiting? = Rate Limiting automatically blocks any IP address that sends an excessive number of requests in a short period. This is extremely effective against denial-of-service (DoS) attacks, aggressive web scrapers, and certain types of brute-force attacks. = What is ASN Blocking? = Every network on the internet has an Autonomous System Number (ASN), like a license plate for a hosting company (e.g., "AS16509" for Amazon Web Services). ASN blocking allows you to block traffic from entire organizations, such as known spam-heavy hosting providers or VPN services, which is much more powerful than blocking individual IP ranges. This feature requires a compatible Geolocation Provider like `ip-api.com` or `ipinfo.io`. = Which Geolocation Provider should I use? = For most users, **ip-api.com** (the new default) is recommended. It is free, requires no API key, and supports all features, including ASN blocking. If you need HTTPS or higher limits, `ipinfo.io` is an excellent alternative (requires a free registration and whitelisting your server IP). = Does ASN or Country Blocking slow down my site by using an API on every page load? = No, it is highly efficient. The plugin uses an intelligent internal cache for geolocation data. When a visitor arrives from a new IP address, the plugin makes a single API call to get its country and ASN information and then caches the result for 24 hours. For all subsequent visits from that same IP address within that 24-hour period, the information is retrieved instantly from the local cache without any external API calls. This ensures that the impact on your site's performance is negligible while maintaining a high level of security. = What is "Whitelist Login Access" and when should I use it? = This is a very powerful security feature that completely blocks access to the WordPress login page (`wp-login.php`) for **every IP address that is NOT on your whitelist**. This will stop 100% of brute-force login attacks. However, you should use it with extreme caution: * **DO NOT USE** this feature if you have a public website where users need to register or log in (e.g., WooCommerce, membership sites). * **ONLY USE** this feature on private sites where only a few administrators with known, static IP addresses need to log in. * **ALWAYS** ensure your own IP address is on the whitelist before enabling this feature. = What is XML-RPC and how does the "Smart Protection" work? = XML-RPC is a legacy interface in WordPress that is a primary target for brute-force attacks. Our **"Smart Protection"** mode is the recommended setting. It uses a powerful, multi-layered approach: 1. **ASN Verification:** It first checks if a request comes from Automattic's official network (AS2635). If it does, the traffic is considered 100% legitimate (from Jetpack, the WordPress/WooCommerce mobile apps, etc.) and is always allowed. 2. **Spoofing Detection:** If a request is *not* from Automattic's network but *claims* to be (by using a fake User-Agent), the plugin identifies it as a spoofed attack and instantly blocks the IP. 3. **Third-Party Whitelist:** It allows traffic from a curated list of known, legitimate third-party services that use XML-RPC, like Microsoft Live Writer. 4. **Fallback:** If the ASN verification service is temporarily unavailable, the system gracefully falls back to a User-Agent check to prevent blocking legitimate users. For maximum security on sites that do not use any XML-RPC services, you can set the mode to **"Completely Disabled"** in the `Settings > General` tab. = Can "Disable User Enumeration" break my site? = It is extremely unlikely. This feature blocks unauthenticated access to the REST API endpoint that lists usernames. Legitimate plugins and themes almost never need to access this list publicly. The security benefit greatly outweighs the minimal risk. = How do the new Push Notifications work? = This feature allows you to receive instant security alerts on platforms like Slack or Discord. It works using "Incoming Webhooks," which are special URLs you can generate in your Slack or Discord channel. 1. In your Slack/Discord channel, create a new Incoming Webhook and copy its URL. 2. In the plugin, go to **Settings > Notifications**. 3. Enable "Push Notifications" and paste the URL into the "Push Webhook URLs" box. You can add multiple URLs, one per line, to send alerts to different services at once. 4. Optionally, add a mention like `@channel` in the "Mentions" box to force a notification on your device. 5. Click the "Send Test Notification" button to verify it's working. This is highly recommended for real-time monitoring, even if you use email for daily or weekly summaries. = How does the Import/Export feature work? = This feature allows you to download a `.json` file of your plugin's configuration. * **Export Template (No API Keys):** Safe to use as a starting point for other websites. * **Export Full Backup (With API Keys):** Creates a complete backup for restoring on the **same site**. The `Import` function will overwrite your current settings. It is a secure process that only imports known plugin options. = How do I enable reCAPTCHA protection? = 1. Get reCAPTCHA keys from the [Google reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create). 2. Go to `Settings > Advanced IP Blocker`. 3. In the "reCAPTCHA Protection" card, check "Enable reCAPTCHA". 4. Select the correct version (v2 or v3) and paste your Site Key and Secret Key. 5. Click "Save Changes". == Compatibility with Other Security Plugins == Can I use Advanced IP Blocker with other security plugins like Wordfence, iThemes Security, etc.? Yes, in most cases. Our plugin is designed to be a focused firewall and can complement larger security suites. However, to avoid conflicts, please follow these guidelines: Choose One Login Protection: Do not enable reCAPTCHA, "Whitelist Login Access", or other login form protections in more than one plugin at a time. Choose which plugin you want to handle login security and disable those features in the other. Check Your Whitelist: Always ensure your server's IP address is on our whitelist (Status & Debug tab). This prevents our plugin from blocking internal scans performed by other security tools. XML-RPC: If you use another plugin to manage XML-RPC, disable the "Disable XML-RPC" option in our plugin to avoid conflicts. In general, features like IP/Country blocking, Honeypots, and User-Agent blocking can run alongside other plugins without issue. == Screenshots == 1. The new Security Dashboard with real-time charts and a Live Attack Map. 2. Modern and intuitive two-level navigation system for easy access to all features. 3. The main Settings page to configure all protection modules like WAF and Rate Limiting. 4. Powerful Web Application Firewall (WAF) with recommended rules. 5. Block entire networks with ASN Blocking, powered by the Spamhaus list. 6. Detailed Blocked IPs table with the "View Map" modal in action. 7. Country Blocking (Geoblocking) with a user-friendly selector and smart warnings. 8. Unified Security Log with a powerful filter to analyze all attack events. 9. Active User Session Management to monitor and terminate logged-in users. 10. Full WP-CLI support documentation, accessible from the "About" tab. 11. An example of a professional HTML email notification. 12. User-Agent management with both block and whitelist capabilities. == Changelog == = 8.4.4.4 - Critical Cache & Telemetry Fixes = * **CRITICAL FIX: Incorrect "Unblocked (Expired)" Status.** Resolved a major bug, most prevalent on sites with a persistent object cache (Redis, Memcached, etc.), where actively blocked IPs would incorrectly display their status as "Unblocked (Expired)" in the "Blocked IPs" table. The status detection logic has been completely overhauled to be resilient to cache desynchronization, ensuring it now always shows the correct, real-time status of a block. * **FIX: Admin Self-Block Prevention.** Added a new "defense-in-depth" safeguard to prevent administrators and editors from being accidentally blocked by the 404/403 error threshold protection. This adds an extra layer of security on top of the whitelist to protect site managers. * **FIX: Telemetry Cron Job Scheduling.** Corrected a logic flaw where the weekly telemetry cron job would not be scheduled immediately after a user gave consent. The task is now scheduled reliably at the moment of opt-in, ensuring data is sent as expected. * **Enhancement: Telemetry Data Collection.** The anonymous telemetry system is now much more comprehensive. It securely collects additional, non-sensitive data about which features are being used (e.g., Honeypot, User-Agent blocking, Push Notifications) and which geolocation provider is active. This will provide invaluable insights to guide future plugin development. * **Enhancement: Whitelist Cache Invalidation.** The plugin now explicitly clears the object cache for the whitelist whenever it is modified. This resolves the root cause of potential race conditions where a newly whitelisted IP might not be recognized immediately on high-performance hosting. * **Tweak:** Updated the `uninstall.php` script to ensure it completely removes all telemetry-related options from the database upon plugin deletion for a 100% clean uninstall. = 8.4.4.3 - The Ultimate Control & Usability Update = * **NEW FEATURE: Bulk Actions for Blocked IPs.** The "Blocked IPs" table is now much more powerful. It includes checkboxes and a "Bulk actions" dropdown, allowing you to unblock multiple selected IPs or ranges at once with a secure confirmation step. * **NEW FEATURE: Unblock All IPs.** A new "Unblock All IPs" option has been added to the "Bulk actions" menu (and WP-CLI via `--all` flag) as a powerful tool to quickly clear all blocklists and transients in an emergency or for site maintenance. * **Enhancement: Individual Unblock Links.** For quick, single-IP management, a convenient "Unblock" link now appears directly below the status of each actively blocked entry in the "Blocked IPs" table. * **Enhancement: Intelligent XML-RPC Protection with ASN Verification.** "Smart Protection" for XML-RPC is now significantly more secure. It verifies if requests claiming to be from services like Jetpack actually originate from Automattic's official network (AS2635), preventing attackers from faking their User-Agent. The system is also resilient to API failures to prevent false positives. * **Enhancement: Smarter Logging.** The "Security Log" is now more informative, showing contextual details for XML-RPC blocks (e.g., "Spoofed Request" vs. "Untrusted User-Agent") and including the triggering URI for User-Agent blocks. * **Enhancement: Support for Comments in Rule Lists.** You can now add comments to the end of lines (using `#`) in the User-Agent lists for better organization, and the plugin will intelligently ignore them. * **Fix:** Resolved a critical bug where an administrator could be accidentally self-blocked by the 404-error protection due to an incorrect CSS file reference. * **Fix:** Corrected the visual display for XML-RPC blocks in "Smart Protection" mode. Attackers now see the standard, formatted "Access Denied" page instead of a blank screen or a plain text message. * **Fix:** Addressed a bug where manually blocked IP ranges could not be unblocked using the individual "Unblock" action. The unblocking logic now correctly handles both single IPs and exact range matches. * **Fix:** All UI elements now correctly display "Permanent" for any block type whose duration is set to 0, ensuring visual consistency across all tables and notifications. = 8.4.4.2 - Critical Hotfix & Intelligence Update = * **CRITICAL FIX:** Resolved a major bug where an administrator could be accidentally self-blocked by the 404-error protection. An incorrect JS file reference in the admin panel was generating repeated 404 errors on every page load, causing the plugin to eventually block the admin's own IP address. This has been corrected. = 8.4.4.1 - Critical Hotfix & Intelligence Update = * **CRITICAL FIX:** Resolved a major bug where an administrator could be accidentally self-blocked by the 404-error protection. An incorrect CSS file reference in the admin panel was generating repeated 404 errors on every page load, causing the plugin to eventually block the admin's own IP address. This has been corrected. * **NEW FEATURE: Intelligent XML-RPC Protection with ASN Verification.** The "Smart Protection" mode for XML-RPC is now significantly more secure. It now verifies if requests claiming to be from services like Jetpack or the WordPress App actually originate from Automattic's official network (ASN 2635). This prevents attackers from bypassing the firewall by simply faking their User-Agent string. The system is resilient to API failures to prevent false positives. * **NEW FEATURE: Live Security Feed Shortcode.** You can now display a real-time feed of security events on any page or post using the `[advaipbl_live_feed]` shortcode. The feed is styled like a terminal, updates automatically, and provides detailed, multi-line information for each block event. * **Enhancement: More Informative Push Notifications.** The webhook notifications for Slack/Discord are now much more detailed. They now include the IP's location, block duration, the specific URI that was attacked, and the full User-Agent, providing a complete incident report in real-time. * **Fix:** The "Reason" field in email notifications, which was empty in some cases, has been fully restored and now contains the correct, detailed block information. * **Fix:** The visual layout of the Security Log has been improved to provide more context. The URI is now correctly displayed for `User-Agent` and `XML-RPC` block events, and the source ("Manual" or "Spamhaus") is shown for ASN blocks. = 8.4.4 - The Intelligence & Control Update = * **NEW MAJOR FEATURE: Push Notifications via Webhooks!** You can now receive instant, real-time security alerts on modern platforms like Slack and Discord. The notifications are highly detailed and configurable, including the IP, location, reason, block duration, and triggering URI. A test button is included for easy setup. * **NEW FEATURE: WAF URL Exclusions.** To prevent conflicts with payment gateways and other complex plugins, you can now specify URL fragments that should be excluded from WAF scanning. The plugin now includes default exclusions for WooCommerce, Stripe, and PayPal to improve compatibility out-of-the-box for e-commerce sites. * **Enhancement: Granular ASN Protection Control.** ASN blocking has been split into two independent controls. You can now enable the automated, self-updating Spamhaus list and your own manual ASN blocklist separately, giving you more flexibility and control over network-level blocking. * **Enhancement: More Informative Security Logs.** The Security Log is now even more detailed. Block events for Rate Limiting, User Agent, XML-RPC, and ASN now include the specific URI that was targeted. Additionally, ASN blocks now clearly state their source ("Manual List" or "Spamhaus"). * **Enhancement: Clearer Dashboard Status.** The "System Status" widget on the dashboard has been improved to be more intuitive. It now shows the distinct status for Spamhaus and Manual ASN protection, and displays the precise XML-RPC protection mode ('Smart Protection', 'Fully Disabled', or 'Not Protected') instead of a simple on/off status. * **Enhancement: Full WP-CLI Support for New Features.** All new functionalities are fully manageable via the command line. New commands include `wp advaipbl waf exclude`, `spamhaus-enable/disable`, and `manual-asn-enable/disable`. * **Fix:** Resolved a critical bug where the "Reason" field in email notifications could be empty after recent logic changes. All email alerts now contain the correct, detailed information. * **Fix:** Corrected a minor UI inconsistency where the "Mentions" textarea for push notifications was incorrectly sized. = 8.4.3.1 - UI Polish & Security Hardening = * **Fix:** Restored correct styling for pagination controls (page numbers) on all data tables (Security Log, Blocked IPs, etc.), which was missed in the 8.4.3 update. * **Security Hardening:** Added a nonce verification to the dashboard's AJAX endpoint to provide an extra layer of security against potential Cross-Site Request Forgery (CSRF) attempts. = 8.4.3 - The Consistency & Polish Update = * **MAJOR FIX: Dashboard & Blocked IPs Synchronization.** Resolved a complex and persistent bug where the Live Attack Map on the dashboard would display more IPs than were actually blocked. The map, the "Blocked IPs" tab, and all block counters are now 100% synchronized and show the exact same real-time data, eliminating "ghost" markers from expired or unblocked IPs. This was achieved by fixing a critical bug in how expired IPv6 addresses were cleaned and by overhauling the data retrieval logic to defeat object caching issues. * **MAJOR FIX: Block Persistence.** Corrected critical logic flaws that prevented certain block types (specifically `Geoblocking` and `XML-RPC`) from being saved to the persistent blocklist. While these IPs were temporarily blocked, they would not appear in the "Blocked IPs" list. This has been fixed, and all block types are now logged and displayed correctly. * **Enhancement: Redesigned Dashboard Layout.** The Security Dashboard layout has been completely overhauled for better readability and data organization. It now features a 3-column top row, a 2-column middle row (for System Status and the Live Attack Map), and a full-width bottom row for the timeline, creating a more professional and balanced view. * **Enhancement: Clustered Map Markers.** The Live Attack Map is now significantly smarter. Markers in the same geographical area are automatically grouped into clusters, showing a count of the IPs within that cluster. This prevents the map from becoming cluttered and provides a much clearer overview of threat origins, especially when dealing with attacks from the same network. * **Enhancement: Enriched Map Popups.** The popups on the Live Attack Map now provide more valuable information. In addition to the IP and location, they now also display the specific **Block Type** (e.g., "WAF Block") and the **Block Duration** (e.g., "120 minutes" or "Permanent"). * **Enhancement: Improved "System Status" Widget.** The System Status widget on the dashboard is now more comprehensive. It now correctly displays the always-on status of `404 Error Blocking`, `403 Error Blocking`, and `Failed Login Blocking` to better educate users about the plugin's core protections. * **Fix:** The layout for the "ASN Blocking" tab has been corrected to use the same two-column widget style as the dashboard, improving UI consistency. * **Fix:** Resolved a visual bug where the "Automated Protection Status" icon on the ASN Blocking tab would not display in green when the feature was active. * **Fix:** Corrected a JavaScript bug that broke the "View Map" modal button functionality in the "Blocked IPs" tab. The modal now opens correctly as intended. * **Tweak:** Added proper attribution for `Leaflet.js` and `Leaflet.markercluster` to the "About" tab in recognition of their use in the new map features. * **Tweak:** Updated translation files (`.pot`) with all new text strings introduced in this version. * **Tweak:** The `uninstall.php` script has been updated to ensure it completely removes all new options and cron jobs (like the Spamhaus cron) upon plugin deletion. = 8.4.2 - The Command Center Update: Dashboard & UI Overhaul = * **NEW MAJOR FEATURE: Security Dashboard!** The old "Status" tab has been transformed into a dynamic, real-time Security Dashboard. It features interactive charts for attack summaries and threat timelines, plus lists of top attacking IPs and countries (with flags!) to provide a clear, visual overview of your site's security. * **MAJOR UX/UI OVERHAUL: Redesigned Admin Navigation.** The entire plugin navigation has been re-architected into a modern, two-level tab system ("Dashboard", "Settings", "Blocking Rules", etc.). This new structure is more intuitive, scalable, and fully responsive, using a horizontally scrollable menu on mobile devices. * **NEW FEATURE: Smart XML-RPC Protection.** Replaced the simple on/off switch for XML-RPC with a three-level protection mode. The new "Smart Protection" (default) blocks malicious requests while automatically allowing trusted services like Jetpack and the WordPress mobile apps to connect, solving a major compatibility issue. * **Enhancement: Unified Security Log.** All individual security log tabs (404, 403, WAF, etc.) have been merged into a single, powerful "Security Log" tab. It features a new dropdown to filter events by type, making it easier to analyze all security-related incidents in one place. * **Enhancement: Smart "Clear Log" Modal.** The "Clear Log" functionality is now safer and more granular. It opens a modal with checkboxes, allowing administrators to select exactly which types of logs they want to delete. * **Enhancement: Floating "Save Changes" Bar.** The main settings page now features a smart, floating save bar that appears only when changes have been made, preventing users from accidentally leaving the page without saving. * **Enhancement: "Duration" Column in Blocked IPs.** The Blocked IPs table now includes a "Duration" column, clearly showing how long each temporary block will last or if it's permanent. * **Fix:** Resolved a long-standing and complex bug where the XML-RPC block was not persistent and did not appear in the Blocked IPs list. The blocking logic has been fully hardened. * **Fix:** Corrected numerous navigation bugs, including broken links in the admin sidebar and `admin bar` after the UI refactor. * **Fix:** Addressed a bug where "Top Attacking Countries" data was not being displayed correctly due to a faulty database query. * **Tweak:** The "General Log" is now a dedicated audit log for administrative actions, separate from the "Security Log" for attack events. * **Tweak:** A huge number of minor bugs, logical inconsistencies, and UI issues have been fixed and polished throughout the plugin for a much more stable and professional user experience. = 8.4.1 - The Sentinel Update: WAF, Rate Limiting & ASN Blocking = * **NEW MAJOR FEATURE: Web Application Firewall (WAF).** A new proactive security layer has been added! You can now create custom rules (using regular expressions) to inspect and block malicious requests (SQLi, XSS, LFI) before they hit WordPress. A comprehensive list of recommended rules is provided. * **NEW MAJOR FEATURE: Request Rate Limiting.** Automatically detect and temporarily block IPs that send an excessive number of requests, providing robust protection against application-level DoS attacks, brute-force attempts, and aggressive scrapers. * **NEW MAJOR FEATURE: ASN Blocking.** You can now block entire networks by blacklisting their Autonomous System Number (ASN). This is a powerful tool to stop traffic from known malicious hosting providers, proxies, and VPN services. * **MAJOR UX/UI OVERHAUL: Redesigned Admin Navigation.** The entire plugin navigation has been re-architected into a modern, two-level tab system ("Settings", "Blocking Rules", "IP Management", "Logs & Sessions"). This new structure is more intuitive, scalable, and fully responsive, using a horizontally scrollable menu on mobile devices. * **Enhancement: Floating "Save Changes" Bar.** The main settings page now features a smart, floating save bar that appears only when changes have been made, preventing users from accidentally leaving the page without saving. It includes a "Discard" option with a custom confirmation modal. * **Enhancement: "Duration" Column.** The "Blocked IPs" table now includes a "Duration" column, clearly showing how long each temporary block will last (e.g., "5 minutes", "24 hours") or if it's "Permanent". * **Enhancement: Default Geolocation Provider.** The default provider for new installations is now `ip-api.com` to ensure out-of-the-box support for ASN blocking without requiring an API key. * **Fix:** Resolved a critical bug that could prevent the plugin from being reactivated due to how the activation hook was called. * **Fix:** Addressed multiple logic flaws that could cause double-blocking scenarios (e.g., an IP blocked by Rate Limit being re-blocked for 403 errors). * **Fix:** Corrected all links in the Admin Menu and Admin Bar to work with the new navigation structure. * **Fix:** Ensured all new features (WAF, Rate Limiting, ASN) are fully integrated with the Import/Export, `uninstall.php`, logging, and WP-CLI systems. * **Fix:** Corrected HTML escaping issue that prevented links from rendering correctly in setting descriptions. * **Tweak:** Updated all help text, feature lists, and WP-CLI documentation to reflect the new capabilities. * **Tested up to WordPress 6.8.2** = 8.4.0 - Major Feature & Stability Update = * **New Feature: Admin Bar Menu & Block Counter!** Added a quick-access "Security" menu to the WordPress admin bar, featuring a live counter of currently blocked IPs. This provides immediate visibility of the plugin's activity. The counter is also displayed in the admin side menu and on the "Blocked IPs" tab for enhanced consistency. * **New Feature: Smart XML-RPC Dependency Detection.** Added a new diagnostic tool in the "Status & Debug" tab that automatically detects active plugins (like Jetpack or WPML) that may rely on XML-RPC, helping users make an informed decision before disabling it. * **New Feature: Advanced Login Log.** The "Login Failure Log" table has been enhanced with new "Method" and "URL" columns, providing crucial insights into the vector of brute-force attacks (e.g., `wp-login.php` vs. `xmlrpc.php`). * **Enhancement: Professional Admin Dropdown Menus.** The main admin tabs and the top bar menu now use nested submenus for better organization and a cleaner, less cluttered interface. * **Enhancement: UI/UX Polish.** Improved various UI elements, including the "per page" selector in tables (now reloads instantly without an extra button click) and the styling of notification counters. * **Fix:** Resolved a major bug where updating the plugin could cause active IP blocks to be cleared prematurely, especially on sites with persistent object caching. A new `resync_block_transients` function now runs on activation to ensure block integrity. * **Fix:** Corrected a logic error that caused the "Clear Log" button to not work for the new WP-Cron log tab. * **Fix:** Addressed several UI redirection bugs, including an issue where exporting settings would fail and redirect to an incorrect page. * Tweak: Default geolocation provider for new installations is now `geoiplookup.net` for enhanced security (HTTPS by default). * Tweak: All code has been reviewed for stability and adherence to WordPress coding standards. = 8.3.9 = * **New Feature:** Full configuration Import/Export for easy backups and migration. * **New Feature:** Real-time AJAX verification for Geolocation API keys. * **Enhancement:** Added full support for blocking and whitelisting CIDR and IP ranges. * **Enhancement:** All log tables now display parsed device and OS information for easier identification. * **Enhancement:** Greatly improved WP-CLI command documentation and added a new `provider` command for Geolocation APIs. * **Enhancement:** Optimized admin performance by using a "just-in-time" cleanup for expired IPs. * **Fix:** Resolved a critical bug where incorrect details were saved for threshold-based blocks. * **Fix:** Fixed multiple bugs in WP-CLI related to Geoblocking and option handling. * **Fix:** Corrected an issue where settings were not being saved correctly due to a form conflict. * **Fix:** Resolved data not being fully removed on uninstall when the option was selected. = 8.3.8 = * New: Added Google reCAPTCHA (v2 & v3) protection for the WordPress login form. * Tweak: All settings are now fully manageable via WP-CLI. * Tweak: Added detailed audit logs for any changes made to reCAPTCHA settings. = 8.3.7 = * **NEW SECURITY FEATURE: Whitelist-Only Login.** Added a highly-secure option to restrict `wp-login.php` access to whitelisted IPs. * **NEW SECURITY FEATURE: User Enumeration Protection.** Added options to prevent username discovery via REST API and author scans. * **ENHANCEMENT:** All email notifications now use a professional HTML template. = 8.3.6 = * FIX: Buttons to save changes in the configuration tab * Tweak: Updated Spanish translations. * Tweak: Updated internal image assets for a refreshed look. = 8.3.5 = * Tweak: Updated internal image assets for a refreshed look. = 8.3.4 = * **NEW FEATURE: Login Failure Log Tab.** A new dedicated "Login Log" tab has been added to the admin panel, allowing administrators to easily view all failed login attempts, including the IP address and the username that was attempted. This completes the set of security logs, providing full visibility into all types of automated attacks. * **ENHANCEMENT: Interactive Admin Notices.** The contextual warnings (e.g., when blocking the server's country) now include an "Add to Whitelist" button, allowing administrators to immediately resolve potential issues with a single click. * **ENHANCEMENT: Improved Email Templates.** All email notifications, including those for threshold-based blocks (404, 403, login), now use a professional HTML template with the plugin logo and a clear, easy-to-read layout. A "View Blocked IPs" button has also been added for quick access. * **ENHANCEMENT: Full Admin Logging for WP-CLI.** All actions performed via WP-CLI that modify data (blocking, whitelisting, changing settings, etc.) are now correctly recorded in the "General Log", ensuring a complete audit trail. * **TWEAK: Flexible Logo Display.** The plugin's header and email templates now correctly handle both square and rectangular logos without distortion, improving brand customization. * FIX: Addressed a bug where the WP-CLI command `geoblock remove` could fail if the data was not in the expected format. * FIX: Solved a critical error in WP-CLI when running `whitelist add` due to a missing internal function. * FIX: Corrected minor visual bugs in tables and controls on mobile devices, ensuring full interface consistency. = 8.3.3 = * **MAJOR UX/UI OVERHAUL:** The entire admin interface has been redesigned for a more professional, modern, and user-friendly experience. * **ENHANCEMENT: New Plugin Header & Card-Style Layout.** The settings pages now feature a custom header and a clean, organized card-style layout, making navigation clearer and more intuitive. * **ENHANCEMENT: Responsive & Mobile-Friendly Interface.** All plugin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring all features are accessible on any screen. * **ENHANCEMENT: Improved Table Controls.** All data tables now include larger, clearer pagination controls and a new dropdown selector to choose the number of items to display per page. * **ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events. * **TWEAK: Improved Email Templates.** Instant notifications and the welcome/setup guide email now use a professional HTML template with the plugin's logo and direct links. * **TWEAK: Admin Action Logging.** All manual actions performed by an administrator (blocking, whitelisting, clearing logs, etc.) are now recorded in the General Log with the corresponding username for better auditing. * FIX: Addressed an issue where admin notices from other plugins could interfere with the plugin's interface. = 8.3.2 = * **ENHANCEMENT: Major Upgrade to Status & Debug Tab.** The diagnostic tab is now a professional-grade tool. It uses an advanced detection system to accurately identify visitor IPs even behind complex networks like Cloudflare, other CDNs, and proxies. It clearly displays the detection method, the proxy chain, and CDN-specific information (like Ray ID and country), making it an invaluable tool for troubleshooting. * **ENHANCEMENT: Cleaner Admin Interface.** The plugin's admin pages now hide distracting notices from other plugins and WordPress core, providing a much cleaner, focused, and more professional user experience. * **FIX: Removed UI "Flicker".** A visual "flicker" or "jump" of the admin notices that occurred on page load has been completely eliminated, resulting in a smoother and more polished interface. * **TWEAK: Improved Server IP Detection.** The mechanism for auto-detecting the server's own IP address (used for auto-whitelisting) has been made more robust to work reliably across a wider variety of hosting environments. = 8.3.1 = * **UX ENHANCEMENT: Improved Admin Tables.** All data tables (Blocked IPs, Whitelist, Logs, etc.) are now more user-friendly. Pagination controls are larger and clearer, and you can now select the number of items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Responsive Admin Interface.** The entire plugin settings area is now fully responsive. The main tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen. * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **TWEAK: Added Helper Descriptions.** Added descriptive helper texts below the threshold and duration settings to better explain what each option does. * **TWEAK: UI Polish.** Minor visual adjustments to the admin panel header and layout for a cleaner and more professional look. * **FIX:** Fixed an issue where admin notices from other plugins could appear within the plugin's header. The interface is now cleaner and only shows relevant notices. = 8.3.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** A highly requested feature is here! You can now easily block or allow access from entire countries via a user-friendly selector in the Settings tab. The plugin also includes smart warnings to prevent you from accidentally blocking your own server or admin IP address. * **NEW FEATURE: Status & Debug Tab.** A new diagnostic tab has been added to help you and your hosting support troubleshoot IP detection issues, especially on sites behind a CDN or proxy. It shows you exactly what IP the plugin detects for your server and your session. * **NEW FEATURE: Test Email Button.** A new button in the Email Notifications settings allows you to instantly send a test email, helping you verify that your WordPress site's email configuration is working correctly. * **UI ENHANCEMENT: Redesigned Admin Panel.** The entire plugin interface has been updated with a more professional and modern look, including a new header, cleaner tabs, and a "card-style" layout for better organization. * **UX ENHANCEMENT: Improved Table Controls.** All data tables (Blocked IPs, Whitelist, Logs) now feature improved, larger pagination controls and a new dropdown selector to let you choose how many items to display per page (20, 50, 100, or 200). * **UX ENHANCEMENT: Searchable General Log.** The General Log tab now includes a search box, making it much easier to find specific events or audit the activity of a particular IP address. * **UX ENHANCEMENT: Responsive & Mobile-Friendly.** The plugin's admin pages are now fully responsive. The tab navigation switches to a user-friendly dropdown menu on mobile devices, and tables can be scrolled horizontally, ensuring a great experience on any screen size. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"), giving you more context. * **ENHANCEMENT: Robust IP Detection.** The logic for detecting both the server's and the visitor's IP address has been significantly improved to be more reliable on complex hosting environments, especially those using CDNs like Cloudflare. * **FIX:** A bug where filtering the "Blocked IPs" list by "404 Error" would not return any results has been resolved. * **FIX:** A critical error in WP-CLI that occurred when adding an IP to the whitelist has been fixed. The CLI is now fully autonomous and synchronized with the admin panel. * **TWEAK:** Added common false-positive URLs (like `/.well-known/traffic-advice` from Google) to the default exclusion list to improve out-of-the-box compatibility. = 8.2.1 = * **Credit tab info update. * **New Spanish translations. = 8.2.0 = * **NEW FEATURE: Country Blocking (Geoblocking)!** You can now block access from entire countries via a user-friendly selector in the settings. * **NEW FEATURE: Test Email Button.** A new button in the settings allows you to instantly verify if your WordPress site's email configuration is working correctly. * **ENHANCEMENT: Smart Geoblock Warnings.** The plugin now detects the country of your server and your own admin IP, providing contextual warnings to prevent you from accidentally blocking yourself or your server. * **ENHANCEMENT: Whitelist Details.** The whitelist table now includes a "Details" column to explain why an IP was added (e.g., "Server IP (auto-added)", "Manually added"). * **ENHANCEMENT: WP-CLI.** Added new WP-CLI commands to manage the geoblocking feature (`wp advaipbl geoblock`). The CLI help has been improved for all commands. * **FIX:** Resolved a bug where a filter in the "Blocked IPs" table was not working correctly. * **FIX:** Solved a critical error in WP-CLI when adding an IP to the whitelist. The CLI is now fully autonomous and synchronized. * **TWEAK:** Added `/.well-known/traffic-advice` to the default URL exclusion list to prevent false positives from Google Chrome's prefetch proxy. = 8.1.0 = * **TWEAK:** Performed a full-code refactoring to unify all internal function, class, and option names to the standard `advaipbl` prefix, as requested by the WordPress.org review team. * **TWEAK:** Hardened the plugin to meet WordPress.org guidelines by fixing all reported security (sanitization, escaping, nonces) and internationalization issues. * **FIX:** Resolved a critical bug where WP-CLI commands were not synchronized with the admin dashboard due to inconsistent option names. * **FIX:** Fixed a bug that prevented the "Delete all data on uninstall" feature from working correctly. * **FIX:** Corrected JavaScript errors related to AJAX actions in the User Sessions panel. = 8.0.2 = * Fix: Resolved a bug that could cause a critical error page when a previously blocked user triggered a new type of block (e.g., 404 errors). * Fix: Ensured all text strings throughout the plugin are correctly internationalized and updated the translation template (`.pot`) file. * Fix: Corrected all `ERROR` and major `WARNING` level issues reported by the WordPress.org Plugin Check tool. * Tweak: Improved security by hardening data sanitization and output escaping across all admin pages. * Tweak: Refined WP-CLI command handling to meet strict WordPress coding standards. = 8.0.0 = * Initial public release on the WordPress.org repository. == Upgrade Notice == = 8.4.4.4 = This is a critical stability update that resolves a major bug causing actively blocked IPs to be incorrectly displayed as "Expired" on sites with object caching. It also hardens the plugin against accidental administrator lockouts and fixes issues with the telemetry system. Updating is highly recommended for all users to ensure data accuracy and reliability.