=== Advanced IP Blocker ===
Contributors: inilerm
Author URI: https://advaipbl.com/
Donate link: https://donate.stripe.com/bJe00kaIP89O1wFfargUM00
Tags: security, firewall, waf, ip blocker, country block, brute force, block ip, rate limit, 2fa, two-factor
Requires at least: 6.7
Tested up to: 6.8
Stable tag: 8.5.8.1
Requires PHP: 8.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A complete WordPress security firewall: blocks IPs, bots & countries. Includes an intelligent WAF, Threat Scoring, Geo-Challenge, 2FA, and Anti-Spoofing.

== Description ==

**Advanced IP Blocker** is your all-in-one security solution to safeguard your WordPress website from a wide range of threats. This plugin provides a comprehensive suite of tools to automatically detect and block malicious activity, including brute-force attacks, vulnerability scanning, and spam bots. With its intuitive interface, you can easily manage whitelists, blocklists, and view detailed security logs to understand exactly how your site is being protected.

> **Important Note on PHP Version:**
> To ensure maximum security and access to all features, we strongly recommend using **PHP 8.1 or higher**. Some advanced features (like the local MaxMind database or full 2FA management via WP-CLI) require PHP 8.1.

**Key Features:**
*   **NEW: Advanced IP Spoofing Protection.** A zero-trust "Trusted Proxies" system ensures the plugin always identifies the true visitor IP, even behind complex setups like Cloudflare or a custom reverse proxy. It neutralizes attacks that attempt to fake their IP, preventing block evasion and the framing of innocent users.
*   **NEW: Geo-Challenge.** A smarter way to handle traffic from high-risk countries. Instead of a hard block, it presents a quick, invisible JavaScript challenge that stops bots but is seamless for human visitors. This reduces unwanted traffic without affecting potential legitimate users.
*   **ENHANCEMENT: Full Bulk-Action Support.** IP management is now faster than ever. Both the Whitelist and the Blocked IPs list now support full bulk actions, allowing you to select and remove multiple entries at once, or unblock all IPs with a single click.
*   **Endpoint Lockdown Mode:** Automatically shields `wp-login.php` and `xmlrpc.php` with a JavaScript challenge during sustained distributed attacks, preventing server overload.
*   **Two-Factor Authentication (2FA):** Secure user accounts with industry-standard TOTP authentication, backup codes, role enforcement, and a central admin management dashboard.
*   **IP Trust & Threat Scoring System:** An intelligent defense that assigns "threat points" to IPs for malicious actions, blocking them only when they reach a configurable score. More accurate and context-aware than simple rules.
*   **Attack Signature Engine (Beta):** Proactively stops distributed botnet attacks by identifying and blocking the attacker's "fingerprint" (signature) instead of just individual IPs.
*   **Web Application Firewall (WAF):** Block malicious requests (SQLi, XSS, etc.) with a customizable ruleset.
*   **And much more:** Rate Limiting, Country & ASN Blocking (with Spamhaus support), ASN Whitelisting, Push Notifications, Google reCAPTCHA, Honeypots, Active User Session Management, and Full WP-CLI Support.

== Installation ==

1.  Upload the `advanced-ip-blocker` folder to the `/wp-content/plugins/` directory.
2.  Activate the plugin through the 'Plugins' menu in WordPress.
3.  A new **"Security"** menu item will appear in your admin sidebar. All settings are located there.
4.  **Crucial:** Visit `Security > Dashboard > System Status` to ensure your IP and your server's IP are whitelisted. Use the one-click buttons if they are not.

== Frequently Asked Questions ==

= What is "Trusted Proxies" and why do I need it? =
This is a critical security feature that prevents IP spoofing. If your site is behind a service like Cloudflare, Varnish, or another reverse proxy, the server's direct connection IP (`REMOTE_ADDR`) will always be the proxy's IP, not the visitor's. The real visitor IP is sent in an HTTP header (e.g., `CF-Connecting-IP`). An attacker can fake this header. The "Trusted Proxies" setting tells the plugin: "Only trust these headers if the request comes from an IP address I know is my proxy." You can add IPs, CIDR ranges, or ASNs (like `AS13335` for Cloudflare) to this list under `Security > Settings > IP Detection`.

= What is Geo-Challenge? How is it different from Geoblocking? =
**Geoblocking** is a hard block. It shows a "403 Access Denied" page to visitors from selected countries.
**Geo-Challenge** is a soft block. It shows a quick, automated JavaScript test to visitors from selected countries. Legitimate humans pass instantly, while most bots are stopped. This is useful for regions you are suspicious of but do not want to block entirely. You can, for example, block Country A and challenge Country B. You can configure it in `Security > Settings > Core Protections`.

= How do I solve issues with the JavaScript challenge and caching plugins? =
The JavaScript challenge (used by Geo-Challenge, Signature Engine, and Endpoint Lockdown) requires dynamic content. Aggressive page caching can interfere with it. If you experience issues (like a challenge loop or a "Verification failed" error), you must configure your caching plugin (e.g., WP Rocket, WP Fastest Cache, LiteSpeed Cache) to **NOT** cache pages for visitors who do not have the `advaipbl_js_verified` cookie. Most caching plugins have a setting like "Never cache pages that use this cookie."

= How do I solve issues with the JavaScript challenge and cookie consent (RGPD/GDPR) plugins? =
Cookie consent plugins (like CookieYes) may block our security cookie from being set. To fix this, you must go into your cookie plugin's settings and classify the cookie named `advaipbl_js_verified` as **"Strictly Necessary"** or "Essential". This will allow the security challenge to function correctly.

= What is the new "Local Database" Geolocation Method? =
For maximum performance, the plugin offers two ways to identify an IP's location (`Security > Settings > Geolocation`):
1.  **Real-time API (Default):** Easy to set up and great for most websites.
2.  **Local Database (Highest Performance):** Downloads the MaxMind GeoLite2 database to your server for instant, offline lookups with zero external API calls. Recommended for high-traffic sites. Requires a free MaxMind license key.

= How do I set up Two-Factor Authentication (2FA)? =
1.  **Admin:** Go to `Security > Settings > Login & User Protection` and enable 2FA globally. You can also enforce it for specific user roles.
2.  **User:** Go to your WordPress Profile page. You will find a new section to set up 2FA by scanning a QR code with an authenticator app and saving your backup codes.

= What is the "Attack Signature Engine"? =
This is an advanced defense that stops botnets by blocking the attacker's "fingerprint" (signature), not just their IP. It works in three phases you can enable in `Security > Settings > Signature Engine`: Logging, Analysis (a background task that finds patterns), and Blocking (presents a JS challenge to malicious signatures). You can manage detected signatures in `IP Management > Blocked Signatures`.

= How should I configure the plugin for my specific website? =

While every website's security needs are unique, here is a general guide to get you started based on your site's profile. For a deep dive into every feature, please consult our [Comprehensive Feature Guide](https://advaipbl.com/comprehensive-feature-guide-advanced-ip-blocker/).

**1. Essential First Steps (For ALL Websites)**

No matter your site type, do these three things immediately after installation to ensure a strong baseline security without locking yourself out:

*   **Whitelist Your IPs:** Go to `Security > Dashboard > System Status` and use the one-click buttons to add your current IP and your server's IP to the whitelist. This is the most critical step.
*   **Activate Trap Defenses:** Go to `Security > Blocking Rules`, and in the "User Agents" and "Honeypot URLs" tabs, copy the suggested lists into the active blocklist text areas. This provides immediate protection from thousands of common bots.
*   **Enable Logging:** Go to `Security > Settings > General` and ensure "Enable Logging" is turned on. This gives you the visibility you need to understand what is happening on your site.

**2. Recommended Profiles**

Once the essentials are done, tailor the configuration to your site type:

**For a Standard Blog or Business Website:**
Your main goal is to block automated threats without affecting administrators.
*   **Enable the IP Trust & Threat Scoring System:** This is the smartest way to block bad actors contextually. The default point values are an excellent starting point. (Found in `Settings > IP Trust & Threat Scoring`).
*   **Enable the WAF and Rate Limiting:** These are powerful proactive defenses. (Found in `Settings > Core Protections` and `Threshold Blocking`).
*   **Enable Spamhaus ASN Protection:** Let the plugin automatically block thousands of known malicious networks for you. (Found in `Settings > Core Protections`).

**For an E-commerce or Membership Site (WooCommerce, etc.):**
You need to protect your site while ensuring legitimate customers from around the world are never blocked.
*   **Enable Two-Factor Authentication (2FA):** This is the single best way to protect administrator and shop manager accounts. Enforce it for these roles in `Settings > Login & User Protection`.
*   **Use Geo-Challenge Instead of Geoblocking:** If you receive attacks from a specific country but also have customers there, use the Geo-Challenge feature instead of a hard block. This will stop bots without affecting human users.
*   **CRITICAL: DO NOT USE "Whitelist Login Access".** This feature will lock out your customers.
*   **WAF Exclusions:** Double-check that URLs for your payment gateways (like Stripe or PayPal webhooks) are in the WAF exclusion list to ensure payments are processed correctly.

**For Any Site Using a CDN or Reverse Proxy (like Cloudflare):**
Your top priority is ensuring the plugin detects the correct visitor IP address.
*   **Configure Trusted Proxies:** Go to `Security > Settings > IP Detection`. Add the IPs or, even better, the ASNs of your CDN/proxy service to this list. For Cloudflare, simply add `AS13335` on a new line. This is essential for the accuracy of all other security features.

== Screenshots ==

1. The new Security Dashboard with real-time charts and a Live Attack Map.
2. Modern and intuitive two-level navigation system for easy access to all features.
3. The main Settings page to configure all protection modules like WAF and Rate Limiting.
4. Powerful Web Application Firewall (WAF) with recommended rules.
5. Block entire networks with ASN Blocking, powered by the Spamhaus list.
6. Detailed Blocked IPs table with the "View Map" modal in action.
7. Country Blocking (Geoblocking) and Geo-Challenge with user-friendly selectors and smart warnings.
8. Unified Security Log with a powerful filter to analyze all attack events.
9. Active User Session Management to monitor and terminate logged-in users.
10. Full WP-CLI support documentation, accessible from the "About" tab.
11. An example of a professional HTML email notification.
12. The new "Trusted Proxies" setting for advanced anti-spoofing protection.
13. IP Trust & Threat Scoring System.
14. Attack Signature Engine (Beta).
15. The new Two-Factor Authentication (2FA) setup section in the user profile.
16. The 2FA Management tab for administrators, showing user status and reset actions.
17. The 2FA prompt on the WordPress login screen after entering a correct password.

== Changelog ==

= 8.5.8.1 =
*   **Fix:** Corrected the `Tested up to` version in the `readme.txt` file to remove the "This plugin has not been tested with your current version of WordPress" warning. The plugin is fully compatible with the latest WordPress version.
*   **Tweak:** Updated and completed missing strings in the Spanish translation.
*   **Note:** This version includes all the major features and enhancements from version 8.5.8, such as the new Trusted Proxies system and Geo-Challenge functionality.

= 8.5.8 =
*   **NEW MAJOR FEATURE: Advanced IP Spoofing Protection.** Implemented a "Trusted Proxies" system to ensure accurate visitor IP detection behind services like Cloudflare or other reverse proxies. The plugin now operates on a zero-trust model, ignoring proxy headers from untrusted sources to prevent block evasion and framing attacks.
*   **NEW MAJOR FEATURE: Geo-Challenge.** Added a new security layer to challenge visitors from selected countries with an invisible JavaScript test instead of a hard block. This is ideal for filtering bot traffic from high-risk regions without affecting legitimate users. The feature is fully configurable and independent of the main Geoblocking module.
*   **Major Enhancement: Full Bulk Actions for IP Management.** The Whitelist and Blocked IPs tables now support full bulk actions. Administrators can select multiple entries to remove/unblock them at once, or unblock all IPs from all lists with a single click, dramatically improving management efficiency.
*   **WP-CLI Expansion:** Added a comprehensive set of new WP-CLI commands to manage all new features from the command line, including `wp advaipbl trusted-proxy`, `wp advaipbl geo-challenge`, `wp advaipbl asn-whitelist`, and `wp advaipbl signature`.
*   **Security & UX Hardening:** The JavaScript challenge page has been completely redesigned. It is now fully responsive, includes enhanced security headers (CSP), and features a more robust user interaction flow with a timeout and manual verification option.
*   **Fix:** Resolved a critical bug where the JavaScript challenge could enter an infinite loop on sites with aggressive page caching or cookie consent (RGPD/GDPR) plugins. The system is now significantly more compatible with these environments.
*   **Fix:** Corrected a bug in WP-CLI where the `session list` command would cause a fatal error due to a missing dependency.
*   **Fix:** Patched a compatibility issue with WP-CLI on servers running PHP versions older than 8.1, preventing fatal errors when using geolocation-dependent commands.
*   **Code Quality: Major Refactor.** The main plugin class (`class-advaipbl-main.php`) has been significantly refactored. All UI rendering logic has been moved to a new dedicated class (`class-advaipbl-admin-pages.php`), separating concerns and making the codebase much more maintainable and scalable for future development.

= 8.5.7 =
*   **NEW FEATURE: Endpoint Lockdown for Login Page.** The automated Endpoint Lockdown defense now protects `wp-login.php` from distributed brute-force attacks.
*   **NEW FEATURE: ASN Whitelist.** You can now whitelist entire networks (ASNs) like Google or Cloudflare to prevent false positives.
*   **Major Fix: Race Condition Elimination.** Refactored the IP blocking mechanism with an atomic, database-level locking system to prevent duplicate blocks during high-frequency attacks.
*   **Security Hardening:** Implemented anti-spoofing intelligence to correctly block attackers faking their IP as `127.0.0.1`.
*   **Fix:** Resolved a bug where the admin dashboard counter could become out of sync on sites with persistent object caching.
*   **Fix:** Corrected a bug causing a fatal error on WP-CLI when used on servers with a CLI PHP version older than 8.1.
*   **Enhancement:** Redesigned the main "Settings" page with a side navigation menu and modern toggle switches.

= For a complete history, please refer to the project's repository. =

== Upgrade Notice ==

= 8.5.8.1 =
This is a recommended maintenance release that fixes the WordPress compatibility warning and updates translations.