=== Advanced IP Blocker ===
Contributors: inilerm
Author URI: https://advaipbl.com/
Donate link: https://donate.stripe.com/bJe00kaIP89O1wFfargUM00
Tags: security, firewall, waf, ip blocker, country block, brute force, block ip, rate limit, 2fa, two-factor
Requires at least: 6.7
Tested up to: 6.8
Stable tag: 8.5.7
Requires PHP: 8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Your complete WordPress security firewall. Blocks IPs, bots & countries. Includes an intelligent WAF, Threat Scoring, and Two-Factor Authentication.

== Description ==

**Advanced IP Blocker** is your all-in-one security solution to safeguard your WordPress website from a wide range of threats. This plugin provides a comprehensive suite of tools to automatically detect and block malicious activity, including brute-force attacks, vulnerability scanning, and spam bots. With its intuitive interface, you can easily manage whitelists, blocklists, and view detailed security logs to understand exactly how your site is being protected.

Whether you're a beginner or an experienced administrator, Advanced IP Blocker gives you the control you need to secure your digital presence.

**Key Features:**
*   **NEW: Endpoint Lockdown Mode:** Automatically shields critical endpoints like `wp-login.php` and `xmlrpc.php` with a JavaScript challenge during sustained distributed attacks, preventing server overload and keeping your block lists clean.
*   **Enhancement: Country & ASN Blocking:** Now includes a powerful **ASN Whitelist** to ensure trusted networks like Google or Cloudflare are never accidentally blocked by other security modules.
*   **NEW: High-Performance Geolocation with Local Database.** For high-traffic sites, you can now switch from real-time API lookups to an offline MaxMind GeoLite2 database. This completely eliminates external API calls for IP lookups, significantly improving TTFB and ensuring maximum performance and reliability, even during DDoS attacks.
*   **Two-Factor Authentication (2FA):** Secure user accounts against password theft with industry-standard TOTP authentication. Features a simple setup process in the user profile, secure backup codes, and a central management dashboard for administrators to enforce 2FA by user role and reset access for locked-out users. Fully manageable via WP-CLI.
*   **Security Dashboard:** Get a real-time, visual overview of threats with interactive charts, a threat timeline, and a live, clustered attack map.
*   **IP Trust & Threat Scoring System:** An advanced, intelligent defense layer that assigns "threat points" to IPs for various malicious actions. IPs are only blocked upon reaching a configurable score, resulting in more accurate, context-aware security.
*   **Attack Signature Engine (Beta):** A proactive defense against distributed botnet attacks. The plugin analyzes request "fingerprints" to identify coordinated attacks and blocks them with an invisible JavaScript challenge.
*   **Web Application Firewall (WAF):** Proactively block malicious requests (SQLi, XSS, LFI) with a customizable ruleset and a URL exclusion system.
*   **Request Rate Limiting:** Automatically prevent DoS attacks by temporarily blocking IPs that make too many requests.
*   **Advanced Login Protection:** Harden your login page by disabling user enumeration via the REST API, author scans, RSS feeds, and oEmbed. Also includes protection against username confirmation errors ("login hinting").
*   **Country & ASN Blocking:** Easily block traffic from entire countries or networks (ASNs), with support for the automated Spamhaus list.
*   **And much more:** Push Notifications, Google reCAPTCHA, Honeypots, Active User Session Management, Full WP-CLI Support, and Detailed Event Logging.

This plugin gives you the power to see who is trying to access your site and to stop threats before they become a problem.

== Installation ==

1.  Upload the `advanced-ip-blocker` folder to the `/wp-content/plugins/` directory.
2.  Activate the plugin through the 'Plugins' menu in WordPress.
3.  A new **"Security"** menu item with a shield icon will appear in your admin sidebar. All settings are located there.
4.  It is highly recommended to visit the `Settings > Status & Debug` tab to ensure your IP and your server's IP are whitelisted.

== Recommended Setup ==

For optimal protection, follow these steps after installation:

1.  **Navigate to the Plugin:** Find the new **"Security"** menu item in your WordPress admin menu.
2.  **Whitelist Your IPs:** Go to `Settings > Status & Debug` and use the one-click buttons to add your current IP and your server's IP to the whitelist. This is the most important step to prevent accidental lockouts.
3.  **Activate Core Defenses:** Go to `Blocking Rules > User Agents`, copy the suggested list of malicious bots, and paste it into the blocklist. Then, go to `Blocking Rules > Honeypot URLs` and do the same. Click "Save" on each page.
4.  **Enable WAF & Rate Limiting:** Go to `Settings > General` and enable the "Web Application Firewall" and "Request Rate Limiting" options for proactive protection.
5.  **Review Login Protection:** Navigate to `Settings > General`. We recommend keeping `Disable User Enumeration` and `Prevent author scans` enabled. Also, consider enabling `Disable XML-RPC` for maximum security (read the FAQ first if you use Jetpack or the mobile app).
6.  **Enable Notifications:** In the `Email Notifications` section on the `Settings` tab, enable notifications to receive alerts or daily/weekly security summaries.
7.  **Configure 2FA (Highly Recommended):** Go to `Settings > General`, find the "Two-Factor Authentication (2FA)" card, and check "Enable Two-Factor Authentication". Then, go to your user profile (top right corner) to set it up for your own account.

That's it! Your plugin is now actively configured to block a wide range of common automated attacks.

== Frequently Asked Questions ==

= What is the ASN Whitelist? =

This is a powerful feature that allows you to "trust" entire networks, overriding all other blocking rules. If an IP address belongs to an ASN (Autonomous System Number) in this list, the plugin will not block it, even if it triggers a WAF rule or has a malicious signature. This is extremely useful for preventing false positives from essential services that use a wide range of IPs, such as:
*   **Google (AS15169):** Ensures Googlebot, Google Ads, etc., can always access your site.
*   **Cloudflare (AS13335):** If you use Cloudflare, whitelisting its ASN can prevent conflicts.
*   **Microsoft/Bing (AS8075):** Ensures Bingbot can crawl your site.

You can manage this list under `Blocking Rules > ASN Blocking`.

= What is "Endpoint Lockdown" mode? =

This is an automated defense system designed to stop large-scale, distributed attacks against critical files. Instead of flooding your block list with thousands of individual IPs during a botnet attack, Lockdown Mode acts like a temporary emergency gate.

When a sustained attack is detected against an endpoint like `wp-login.php` or `xmlrpc.php`, this mode activates automatically. While active, all suspicious traffic to that specific endpoint is met with a JavaScript challenge. This instantly filters out bots without affecting legitimate users and without adding thousands of entries to your block lists. You can see which endpoints are currently in lockdown and manually cancel it from the `IP Management > Blocked Endpoints` tab.

= What is the new "Local Database" Geolocation Method? =

For maximum performance, the plugin now offers two ways to identify the location of an IP address, which you can choose in `Security > Settings > General > Geolocation Settings`:

1.  **Real-time API (Default):** This method is easy to set up and queries an external service the first time a new IP is seen. It's great for most websites.
2.  **Local Database (Highest Performance):** This method downloads the MaxMind GeoLite2 database directly to your server. All IP lookups are then performed locally and instantly, with **zero external API calls**. This is the recommended option for high-traffic websites or for anyone seeking the best possible performance and reliability, as it is immune to external API downtime or rate limits. To use this feature, you will need a free MaxMind license key.

= How do I set up Two-Factor Authentication (2FA)? =

Setting up 2FA is a simple two-step process:

**1. For Site Administrators:**
*   First, you must enable the feature globally. Go to `Security > Settings > General`.
*   Find the card named "Two-Factor Authentication (2FA)" and check the box to "Enable Two-Factor Authentication".
*   Optionally, you can select user roles (like "Administrator") that will be required to set up 2FA.
*   Click "Save Changes".

**2. For Individual Users:**
*   Once the feature is enabled globally, go to your profile page (by clicking your name in the top-right admin bar and selecting "Edit Profile").
*   You will see a new "Two-Factor Authentication (2FA)" section. Click the "Set Up 2FA" button.
*   Scan the QR code with an authenticator app (like Google Authenticator, Authy, or 1Password).
*   **Crucially, save the provided backup codes in a safe place.** These are your only way to get back in if you lose your device.
*   Enter the 6-digit code from your app into the verification field and click "Activate".
*   That's it! The next time you log in, you will be asked for your 6-digit code after entering your password.

= What is the "2FA Management" tab? =

This is a dashboard for administrators, located under `Security > Settings > 2FA Management`. It allows you to:
*   See a list of all users and their current 2FA status ("Active" or "Inactive").
*   Quickly identify users in forced roles who have not yet configured 2FA (marked as "Inactive (Required)").
*   **Reset 2FA** for any user who has lost both their device and their backup codes. This is a critical rescue tool to prevent users from being permanently locked out.

= I can't find the plugin's settings! =

After activation, the plugin adds a main menu item named **"Security"** (with a shield icon) to your WordPress admin sidebar. All features are now organized into logical parent tabs: **Dashboard, Settings, Blocking Rules, IP Management, Logs & Sessions, and About**.

= What does the new Security Dashboard show? =

The dashboard provides a real-time overview of your site's security. It includes interactive charts showing the volume and types of attacks over the last 7 days, as well as lists of the top attacking IPs and countries. It's the best way to see the plugin working to protect your site.

= What is the new "IP Trust & Threat Scoring" system? =

Previously, some plugin features worked on a simple "three strikes and you're out" basis (e.g., "block after 10 errors"). The new IP Trust system is a much more intelligent "demerit points" system that understands context.

Here’s how it works:
1.  **Points Accumulation:** Each suspicious action (like a 404 error, a failed login, or a WAF trigger) adds a specific number of "threat points" to an IP's score.
2.  **Configurable Weights:** You can decide exactly how many points each action is worth. For example, a critical WAF event like an SQL injection attempt can be worth 100 points (an instant block), while a single 404 error might only be worth 5.
3.  **Threshold Blocking:** An IP is only blocked when its total score reaches a threshold that you define (e.g., 100 points).

This is far more accurate because it evaluates the overall behavior of an IP. What makes it truly powerful is the **automatic score decay**. The plugin will periodically reduce the score of inactive IPs, allowing them to "redeem" themselves over time. This means less manual management for you! You can find all the settings for this feature under `Security > Settings > General`, and you can monitor active IP scores in the new `Logs & Sessions > IP Trust Log` tab.

= What is the "Attack Signature Engine"? How do I use it? =

This is our most advanced defense layer, designed to stop large-scale, automated attacks from botnets. While traditional methods block one IP at a time, this engine blocks the attacker's **"fingerprint"** (or **signature**), neutralizing an entire botnet at once.

**How It Works: Learning and Acting**

1.  **Logging (Phase 1):** When you enable "Signature Logging", the plugin records the anonymous fingerprints of your visitors (User-Agent, browser headers, etc.).
2.  **Analysis (Phase 2):** When you enable "Signature Analysis", a background task runs every hour. It looks for signatures that have been used by an unusually high number of different IPs, which is a clear sign of a coordinated bot attack. It then adds these malicious signatures to a blocklist.
3.  **Action (Phase 3):** When you enable "Signature Blocking", any visitor matching a malicious signature is met with an invisible **JavaScript challenge**. Human visitors pass instantly, but automated bots fail and are blocked.

**Your Role: Teaching the System**

This is a learning system, and you are the teacher. Sometimes, legitimate distributed services (like search engine crawlers or uptime monitors) can look like a botnet. Your logs and notifications are crucial for training the engine.

*   **If you see a "Signature Flagged" notification** with a User-Agent you recognize (like Googlebot, Bingbot, Facebook, etc.):
    1.  Go to `IP Management > Blocked Signatures`.
    2.  Find the signature and click the **"Whitelist"** button.
*   This teaches the plugin to trust that signature permanently. By doing this for a few legitimate services, you will quickly build a highly accurate and powerful defense system tailored to your site's traffic.

= What is a Web Application Firewall (WAF)? =

The WAF is a proactive security layer. It inspects incoming web traffic for malicious patterns (like SQL injection or cross-site scripting) and blocks the request before it can reach WordPress, protecting you from vulnerabilities in other plugins or themes. You can add your own custom rules in the `Blocking Rules > Firewall (WAF)` tab.

= What is Rate Limiting? =

Rate Limiting automatically blocks any IP address that sends an excessive number of requests in a short period. This is extremely effective against denial-of-service (DoS) attacks, aggressive web scrapers, and certain types of brute-force attacks.

= What is ASN Blocking? =

Every network on the internet has an Autonomous System Number (ASN), like a license plate for a hosting company (e.g., "AS16509" for Amazon Web Services). ASN blocking allows you to block traffic from entire organizations, such as known spam-heavy hosting providers or VPN services, which is much more powerful than blocking individual IP ranges. This feature requires a compatible Geolocation Provider like `ip-api.com` or `ipinfo.io`.

= Which Geolocation Provider should I use? =

For most users, **ip-api.com** (the new default) is recommended. It is free, requires no API key, and supports all features, including ASN blocking. If you need HTTPS or higher limits, `ipinfo.io` is an excellent alternative (requires a free registration and whitelisting your server IP).

= Does ASN or Country Blocking slow down my site by using an API on every page load? =

No, it is highly efficient. The plugin uses an intelligent internal cache for geolocation data. When a visitor arrives from a new IP address, the plugin makes a single API call to get its country and ASN information and then caches the result for 24 hours. For all subsequent visits from that same IP address within that 24-hour period, the information is retrieved instantly from the local cache without any external API calls. This ensures that the impact on your site's performance is negligible while maintaining a high level of security.

= What is "Whitelist Login Access" and when should I use it? =

This is a very powerful security feature that completely blocks access to the WordPress login page (`wp-login.php`) for **every IP address that is NOT on your whitelist**. This will stop 100% of brute-force login attacks. However, you should use it with extreme caution:
*   **DO NOT USE** this feature if you have a public website where users need to register or log in (e.g., WooCommerce, membership sites).
*   **ONLY USE** this feature on private sites where only a few administrators with known, static IP addresses need to log in.
*   **ALWAYS** ensure your own IP address is on the whitelist before enabling this feature.

= What is XML-RPC and how does the "Smart Protection" work? =

XML-RPC is a legacy interface in WordPress that is a primary target for brute-force attacks. Our **"Smart Protection"** mode is the recommended setting. It uses a powerful, multi-layered approach:
1.  **ASN Verification:** It first checks if a request comes from Automattic's official network (AS2635). If it does, the traffic is considered 100% legitimate (from Jetpack, the WordPress/WooCommerce mobile apps, etc.) and is always allowed.
2.  **Spoofing Detection:** If a request is *not* from Automattic's network but *claims* to be (by using a fake User-Agent), the plugin identifies it as a spoofed attack and instantly blocks the IP.
3.  **Third-Party Whitelist:** It allows traffic from a curated list of known, legitimate third-party services that use XML-RPC, like Microsoft Live Writer.
4.  **Fallback:** If the ASN verification service is temporarily unavailable, the system gracefully falls back to a User-Agent check to prevent blocking legitimate users.

For maximum security on sites that do not use any XML-RPC services, you can set the mode to **"Completely Disabled"** in the `Settings > General` tab.

= What is the new "Endpoint Lockdown" mode for XML-RPC? =

This is an advanced, automated defense system designed to stop large-scale, distributed brute-force attacks against the `xmlrpc.php` file. Instead of flooding your block list with thousands of individual IPs, Lockdown Mode acts like a temporary emergency gate.

Here's how it works:
1.  **Detection:** The plugin monitors for a rapid increase in blocks targeting `xmlrpc.php`.
2.  **Activation:** Once a certain threshold is met (e.g., 10 blocks in 15 minutes), Lockdown Mode activates automatically for a set duration (e.g., 60 minutes).
3.  **Action:** While active, all non-whitelisted traffic to `xmlrpc.php` is met with a JavaScript challenge. This instantly filters out bots without adding any more IPs to your block list. Legitimate services like Jetpack are unaffected.
4.  **Notification:** You receive an alert when Lockdown Mode activates, so you're aware of the attempted attack.

This feature provides robust protection against botnet attacks while keeping your block lists clean and manageable. You can configure it under `Settings > General > Advanced Login Protection`.

= Can the plugin block my server's own IP (127.0.0.1)? What if an attacker tries to trick it? =

No, the plugin now includes **two layers of intelligent protection** to prevent this critical issue.

1.  **Anti-Spoofing Intelligence:** The plugin can now detect when an external attacker tries to "spoof" or fake their IP as `127.0.0.1` by manipulating HTTP headers. When this specific attack pattern is detected, the plugin ignores the fake IP and instead blocks the **attacker's real IP address** (`REMOTE_ADDR`), turning their own attack against them.
2.  **Internal Request Safeguard:** For genuine internal requests originating from your own server (like WP-Cron), the plugin recognizes them as safe and will **never** block `127.0.0.1` or `::1` (the IPv6 equivalent).

This dual approach ensures that your server's internal processes can run without interruption while still catching and blocking attackers who try to exploit this vector.

= Can "Disable User Enumeration" break my site? =

It is extremely unlikely. This feature blocks unauthenticated access to the REST API endpoint that lists usernames. Legitimate plugins and themes almost never need to access this list publicly. The security benefit greatly outweighs the minimal risk.

= How do the new Push Notifications work? =

This feature allows you to receive instant security alerts on platforms like Slack or Discord. It works using "Incoming Webhooks," which are special URLs you can generate in your Slack or Discord channel.

1.  In your Slack/Discord channel, create a new Incoming Webhook and copy its URL.
2.  In the plugin, go to **Settings > Notifications**.
3.  Enable "Push Notifications" and paste the URL into the "Push Webhook URLs" box. You can add multiple URLs, one per line, to send alerts to different services at once.
4.  Optionally, add a mention like `@channel` in the "Mentions" box to force a notification on your device.
5.  Click the "Send Test Notification" button to verify it's working.

This is highly recommended for real-time monitoring, even if you use email for daily or weekly summaries.

= How does the Import/Export feature work? =

This feature allows you to download a `.json` file of your plugin's configuration.
*   **Export Template (No API Keys):** Safe to use as a starting point for other websites.
*   **Export Full Backup (With API Keys):** Creates a complete backup for restoring on the **same site**.
The `Import` function will overwrite your current settings. It is a secure process that only imports known plugin options.

= How do I enable reCAPTCHA protection? =
1. Get reCAPTCHA keys from the [Google reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create).
2. Go to `Settings > Advanced IP Blocker`.
3. In the "reCAPTCHA Protection" card, check "Enable reCAPTCHA".
4. Select the correct version (v2 or v3) and paste your Site Key and Secret Key.
5. Click "Save Changes".

== Compatibility with Other Security Plugins ==
Can I use Advanced IP Blocker with other security plugins like Wordfence, iThemes Security, etc.?
Yes, in most cases. Our plugin is designed to be a focused firewall and can complement larger security suites. However, to avoid conflicts, please follow these guidelines:
Choose One Login Protection: Do not enable reCAPTCHA, "Whitelist Login Access", or other login form protections in more than one plugin at a time. Choose which plugin you want to handle login security and disable those features in the other.
Check Your Whitelist: Always ensure your server's IP address is on our whitelist (Status & Debug tab). This prevents our plugin from blocking internal scans performed by other security tools.
XML-RPC: If you use another plugin to manage XML-RPC, disable the "Disable XML-RPC" option in our plugin to avoid conflicts.
In general, features like IP/Country blocking, Honeypots, and User-Agent blocking can run alongside other plugins without issue.

== Screenshots ==

1. The new Security Dashboard with real-time charts and a Live Attack Map.
2. Modern and intuitive two-level navigation system for easy access to all features.
3. The main Settings page to configure all protection modules like WAF and Rate Limiting.
4. Powerful Web Application Firewall (WAF) with recommended rules.
5. Block entire networks with ASN Blocking, powered by the Spamhaus list.
6. Detailed Blocked IPs table with the "View Map" modal in action.
7. Country Blocking (Geoblocking) with a user-friendly selector and smart warnings.
8. Unified Security Log with a powerful filter to analyze all attack events.
9. Active User Session Management to monitor and terminate logged-in users.
10. Full WP-CLI support documentation, accessible from the "About" tab.
11. An example of a professional HTML email notification.
12. User-Agent management with both block and whitelist capabilities.
13. IP Trust & Threat Scoring System.
14. Attack Signature Engine (Beta)
15. The new Two-Factor Authentication (2FA) setup section in the user profile.
16. The 2FA Management tab for administrators, showing user status and reset actions.
17. The 2FA prompt on the WordPress login screen after entering a correct password.

== Changelog ==

= 8.5.7 - The Reliability & Intelligence Update =
*   **NEW MAJOR FEATURE: Endpoint Lockdown for Login Page.** The automated Endpoint Lockdown defense now protects `wp-login.php` from distributed brute-force attacks by activating a JavaScript challenge, preserving server resources and keeping block lists clean.
*   **NEW MAJOR FEATURE: ASN Whitelist.** You can now whitelist entire networks (ASNs) like Google or Cloudflare, ensuring their IPs are never blocked by any security module, preventing false positives from essential services.
*   **Major Fix: Race Condition Elimination.** The IP blocking mechanism has been completely refactored with an atomic, database-level locking system. This resolves critical race conditions during high-frequency attacks, preventing duplicate IP blocks and notification floods.
*   **Security Hardening: Anti-Spoofing Intelligence.** The IP detection system is now much smarter. It can identify when an attacker fakes their IP as localhost (`127.0.0.1`) and blocks the attacker's real IP address instead, turning the attack against them.
*   **Security Hardening: Universal Localhost Protection.** All security modules now correctly identify and ignore genuine internal server requests (`127.0.0.1` and `::1`), preventing critical bugs where the server could block itself.
*   **Security Hardening: XML-RPC "Disabled" Mode.** The "Completely Disabled" mode for XML-RPC now blocks all requests to `xmlrpc.php` at a very early stage, including discovery requests (`?rsd`), closing a previously identified loophole.
*   **Fix:** Resolved a bug where the admin dashboard counter for blocked IPs could become out of sync on sites using persistent object caching (e.g., Docket Cache).
*   **Fix:** Corrected a bug where the plugin would cause a fatal error on WP-CLI when used on servers with a CLI PHP version older than 8.1. The plugin now gracefully degrades and shows a warning for incompatible commands.
*   **Enhancement:** Redesigned the main "Settings" page with a side navigation menu for a vastly improved user experience on large screens.
*   **Enhancement:** Replaced all checkboxes in the Settings page with modern toggle switches for better usability.
*   **Enhancement:** Improved the reliability of the Spamhaus list auto-updater by moving its scheduling logic to a more robust hook.
*   **Code Quality:** Eliminated all critical `ERROR` level notices from Plugin Check, including strict internationalization, escaping, and prepared SQL standards.

= 8.5.6 - The Reliability & Intelligence Update =
*   **NEW: Anti-Spoofing Intelligence.** The plugin can now detect when an external attacker attempts to hide their identity by faking their IP as localhost (`127.0.0.1`). Instead of blocking the fake IP, the plugin now blocks the attacker's real IP, turning the attack against them.
*   **NEW: Endpoint Lockdown Mode.** A new automated defense system to counter large-scale, distributed attacks against `xmlrpc.php`. When a sustained attack is detected, this mode activates and presents a JavaScript challenge to all suspicious traffic, stopping the botnet without flooding your block lists.
*   **Major Fix: Race Condition Elimination.** The entire IP blocking mechanism has been refactored with an atomic locking system. This completely resolves "race conditions" that could occur during high-frequency attacks (e.g., from JMeter tests), preventing duplicate IP blocks and redundant notifications. The plugin is now fully resilient against attack floods.
*   **Security Hardening: Universal Localhost Protection.** A new global safeguard has been implemented that prevents the plugin from ever blocking internal server requests (`127.0.0.1` and `::1`), protecting critical functions like WP-Cron from being accidentally disrupted.
*   **Security Hardening: Improved IP Detection.** The IP detection logic has been enhanced to correctly identify the true visitor IP on servers with poorly configured reverse proxies, further improving accuracy.
*   **Fix:** Resolved a persistent bug in the "Blocked IPs" table where the "Per Page" filter would not work correctly due to a conflict with the bulk actions form.
*   **Code Quality:** Addressed numerous PHPCS errors and warnings reported by Plugin Check, including strict internationalization standards, escaping, and WordPress best practices, ensuring higher code quality and compatibility.
*   **Code Quality:** All third-party scripts and styles (Chart.js, Leaflet.js, etc.) are now bundled locally with the plugin instead of being loaded from external CDNs, complying with WordPress.org security and privacy requirements.

= 8.5.5 - The Performance & Scalability Update =
*   **NEW MAJOR FEATURE: High-Performance Geolocation via Local Database.** You can now switch from real-time API lookups to a local MaxMind GeoLite2 database. This eliminates external API calls for geolocation, significantly improving TTFB and site performance. It's the recommended solution for high-traffic sites and is fully integrated with an automated downloader and weekly updater.
*   **Performance Enhancement: Dedicated Cache Table.** Volatile data like the geolocation cache is now stored in a dedicated custom database table (`_advaipbl_cache`) instead of using WordPress transients. This prevents bloating the `wp_options` table on high-traffic sites, improving overall database performance and scalability, addressing key feedback from performance experts.
*   **Enhancement:** The Rate Limiting module has been refactored to use the new dedicated cache table, making it more robust against high-frequency requests.
*   **Enhancement:** Added a cron job to automatically update the local GeoIP databases weekly, ensuring the data remains fresh.
*   **Enhancement:** The `uninstall.php` script has been updated to completely remove the new cache table and the downloaded GeoIP database files from the `wp-content/uploads` directory, ensuring a 100% clean uninstall.
*   **Enhancement:** The Telemetry system has been updated to track the adoption of the new Local Database geolocation method.
*   **Fix:** Resolved a bug in the WP-Cron Log where the table was not displaying detailed information correctly. It now includes the triggering URI and a list of scheduled hooks due to run.
*   **Fix:** The "Source" of a WP-Cron execution (Server or External) is now correctly identified and displayed in the log, making it easier to diagnose cron-related issues.
*   **Fix:** Solved multiple bugs in the User Sessions and Blocked IPs tables where location information would not display correctly when using the new Local Database method.
*   **Fix:** Corrected an issue where the "Clear Location Cache" button was not clearing the new custom cache table.
*   **Fix:** Addressed a bug with the `ip-api.com` provider that could cause errors on sites using HTTPS without an API key.

= 8.5.4 - The Fortress Update: Two-Factor Authentication & Hardening =
*   **NEW MAJOR FEATURE: Two-Factor Authentication (2FA).** Secure user accounts with industry-standard Time-Based One-Time Password (TOTP) protection. The implementation is robust, user-friendly, and fully integrated into WordPress.
*   **New: User-Friendly Setup & Login.** Users can enable 2FA from their profile with a simple QR code scan and secure backup codes. The login process is enhanced with a secure two-step verification flow.
*   **New: Administrator Management Dashboard.** A new "2FA Management" tab allows administrators to view the 2FA status of all users, filter by role, and search.
*   **New: Enforce 2FA by User Role.** Administrators can now require specific user roles to set up 2FA, enforcing a higher security standard. Users in forced roles will see a persistent admin notice until they comply.
*   **New: Emergency 2FA Reset.** From the management dashboard, an administrator can instantly reset the 2FA configuration for any user who is locked out.
*   **New: Full WP-CLI Support for 2FA.** Added new commands (`wp advaipbl 2fa status` and `wp advaipbl 2fa reset`) to manage user 2FA status from the command line.
*   **New: Email Notifications for 2FA Events.** Users are automatically notified when 2FA is activated, deactivated, reset, or when a backup code is used.
*   **Security Hardening: User Enumeration Protection.** The "REST API User Protection" feature is now more comprehensive, adding protection against user enumeration via RSS Feeds and the oEmbed API endpoint.
*   **Security Hardening: Login Hinting Protection.** Added a new "Prevent Login Hinting" option (enabled by default) that shows generic error messages on the login and lost password forms, preventing attackers from confirming if a username or email exists.
*   **Compatibility:** The entire 2FA module is built to gracefully degrade on older PHP versions in CLI environments, preventing fatal errors while maintaining WP-CLI functionality. This version requires PHP 8.0 or higher for 2FA features.
*   **Enhancement:** The "System Status" widget on the Security Dashboard and the anonymous telemetry system have been updated to include the global 2FA status.
*   **Enhancement:** Updated all translation strings for new features.

= Previous Versions =
*   For a complete history, please refer to the project's repository.

== Upgrade Notice ==

= 8.5.7 =
This is a critical reliability and security update. It resolves race conditions, fixes a fatal error with WP-CLI on some servers, and adds powerful new defenses against IP spoofing and distributed attacks. Updating is highly recommended for all users.