Advanced IP Blocker

After activation, the plugin adds a main menu item named "Security" (with a shield icon) to your WordPress admin sidebar. All features are now organized into logical parent tabs: Dashboard, Settings, Blocking Rules, IP Management, Logs & Sessions, and About.

The dashboard provides a real-time overview of your site's security. It includes interactive charts showing the volume and types of attacks over the last 7 days, as well as lists of the top attacking IPs and countries. It's the best way to see the plugin working to protect your site.

Previously, some plugin features worked on a simple "three strikes and you're out" basis (e.g., "block after 10 errors"). The new IP Trust system is a much more intelligent "demerit points" system that understands context. Here’s how it works:

1. Points Accumulation: Each suspicious action (like a 404 error, a failed login, or a WAF trigger) adds a specific number of "threat points" to an IP's score.
2. Configurable Weights: You can decide exactly how many points each action is worth. For example, a critical WAF event like an SQL injection attempt can be worth 100 points (an instant block), while a single 404 error might only be worth 5.
3. Threshold Blocking: An IP is only blocked when its total score reaches a threshold that you define (e.g., 100 points). This is far more accurate because it evaluates the overall behavior of an IP. What makes it truly powerful is the automatic score decay. The plugin will periodically reduce the score of inactive IPs, allowing them to "redeem" themselves over time. This means less manual management for you! You can find all the settings for this feature under Security > Settings > General, and you can monitor active IP scores in the new Logs & Sessions > IP Trust Log tab.

This is our most advanced defense layer, designed to stop large-scale, automated attacks from botnets. While traditional methods block one IP at a time, this engine blocks the attacker's "fingerprint" (or signature), neutralizing an entire botnet at once. How It Works: Learning and Acting

1. Logging (Phase 1): When you enable "Signature Logging", the plugin records the anonymous fingerprints of your visitors (User-Agent, browser headers, etc.).
2. Analysis (Phase 2): When you enable "Signature Analysis", a background task runs every hour. It looks for signatures that have been used by an unusually high number of different IPs, which is a clear sign of a coordinated bot attack. It then adds these malicious signatures to a blocklist.
3. Action (Phase 3): When you enable "Signature Blocking", any visitor matching a malicious signature is met with an invisible JavaScript challenge. Human visitors pass instantly, but automated bots fail and are blocked.

• If you see a "Signature Flagged" notification with a User-Agent you recognize (like Googlebot, Bingbot, Facebook, etc.):
• Go to IP Management > Blocked Signatures.
• Find the signature and click the "Whitelist" button.
• This teaches the plugin to trust that signature permanently. By doing this for a few legitimate services, you will quickly build a highly accurate and powerful defense system tailored to your site's traffic.

The WAF is a proactive security layer. It inspects incoming web traffic for malicious patterns (like SQL injection or cross-site scripting) and blocks the request before it can reach WordPress, protecting you from vulnerabilities in other plugins or themes. You can add your own custom rules in the Blocking Rules > Firewall (WAF) tab.

Rate Limiting automatically blocks any IP address that sends an excessive number of requests in a short period. This is extremely effective against denial-of-service (DoS) attacks, aggressive web scrapers, and certain types of brute-force attacks.

Every network on the internet has an Autonomous System Number (ASN), like a license plate for a hosting company (e.g., "AS16509" for Amazon Web Services). ASN blocking allows you to block traffic from entire organizations, such as known spam-heavy hosting providers or VPN services, which is much more powerful than blocking individual IP ranges. This feature requires a compatible Geolocation Provider like ip-api.com or ipinfo.io.

For most users, ip-api.com (the new default) is recommended. It is free, requires no API key, and supports all features, including ASN blocking. If you need HTTPS or higher limits, ipinfo.io is an excellent alternative (requires a free registration and whitelisting your server IP).

No, it is highly efficient. The plugin uses an intelligent internal cache for geolocation data. When a visitor arrives from a new IP address, the plugin makes a single API call to get its country and ASN information and then caches the result for 24 hours. For all subsequent visits from that same IP address within that 24-hour period, the information is retrieved instantly from the local cache without any external API calls. This ensures that the impact on your site's performance is negligible while maintaining a high level of security.

This is a very powerful security feature that completely blocks access to the WordPress login page (wp-login.php) for every IP address that is NOT on your whitelist. This will stop 100% of brute-force login attacks. However, you should use it with extreme caution:

• DO NOT USE this feature if you have a public website where users need to register or log in (e.g., WooCommerce, membership sites).
• ONLY USE this feature on private sites where only a few administrators with known, static IP addresses need to log in.
• ALWAYS ensure your own IP address is on the whitelist before enabling this feature.

XML-RPC is a legacy interface in WordPress that is a primary target for brute-force attacks. Our "Smart Protection" mode is the recommended setting. It uses a powerful, multi-layered approach:

1. ASN Verification: It first checks if a request comes from Automattic's official network (AS2635). If it does, the traffic is considered 100% legitimate (from Jetpack, the WordPress/WooCommerce mobile apps, etc.) and is always allowed.
2. Spoofing Detection: If a request is not from Automattic's network but claims to be (by using a fake User-Agent), the plugin identifies it as a spoofed attack and instantly blocks the IP.
3. Third-Party Whitelist: It allows traffic from a curated list of known, legitimate third-party services that use XML-RPC, like Microsoft Live Writer.
4. Fallback: If the ASN verification service is temporarily unavailable, the system gracefully falls back to a User-Agent check to prevent blocking legitimate users. For maximum security on sites that do not use any XML-RPC services, you can set the mode to "Completely Disabled" in the Settings > General tab.

It is extremely unlikely. This feature blocks unauthenticated access to the REST API endpoint that lists usernames. Legitimate plugins and themes almost never need to access this list publicly. The security benefit greatly outweighs the minimal risk.

This feature allows you to receive instant security alerts on platforms like Slack or Discord. It works using "Incoming Webhooks," which are special URLs you can generate in your Slack or Discord channel.

1. In your Slack/Discord channel, create a new Incoming Webhook and copy its URL.
2. In the plugin, go to Settings > Notifications.
3. Enable "Push Notifications" and paste the URL into the "Push Webhook URLs" box. You can add multiple URLs, one per line, to send alerts to different services at once.
4. Optionally, add a mention like @channel in the "Mentions" box to force a notification on your device.
5. Click the "Send Test Notification" button to verify it's working.

This feature allows you to download a .json file of your plugin's configuration.

• Export Template (No API Keys): Safe to use as a starting point for other websites.
• Export Full Backup (With API Keys): Creates a complete backup for restoring on the same site. The Import function will overwrite your current settings. It is a secure process that only imports known plugin options.

1. Get reCAPTCHA keys from the Google reCAPTCHA Admin Console.
2. Go to Settings > Advanced IP Blocker.
3. In the "reCAPTCHA Protection" card, check "Enable reCAPTCHA".
4. Select the correct version (v2 or v3) and paste your Site Key and Secret Key.
5. Click "Save Changes".