Advanced IP Blocker

After activation, the plugin adds a main menu item named "Security" (with a shield icon) to your WordPress admin sidebar. The settings are now organized into logical tabs like "Settings", "Blocking Rules", and "IP Management".

The WAF is a proactive security layer. It inspects incoming web traffic for malicious patterns (like SQL injection or cross-site scripting) and blocks the request before it can reach WordPress, protecting you from vulnerabilities in other plugins or themes. You can add your own custom rules in the Blocking Rules > Firewall (WAF) tab.

Rate Limiting automatically blocks any IP address that sends an excessive number of requests in a short period. This is extremely effective against denial-of-service (DoS) attacks, aggressive web scrapers, and certain types of brute-force attacks.

Every network on the internet has an Autonomous System Number (ASN), like a license plate for a hosting company (e.g., "AS16509" for Amazon Web Services). ASN blocking allows you to block traffic from entire organizations, such as known spam-heavy hosting providers or VPN services, which is much more powerful than blocking individual IP ranges. This feature requires a compatible Geolocation Provider like ip-api.com or ipinfo.io.

For most users, ip-api.com (the new default) is recommended. It is free, requires no API key, and supports all features, including ASN blocking. If you need HTTPS or higher limits, ipinfo.io is an excellent alternative (requires a free registration and whitelisting your server IP).

This is a very powerful security feature that completely blocks access to the WordPress login page (wp-login.php) for every IP address that is NOT on your whitelist. This will stop 100% of brute-force login attacks. However, you should use it with extreme caution:

• DO NOT USE this feature if you have a public website where users need to register or log in (e.g., WooCommerce, membership sites).
• ONLY USE this feature on private sites where only a few administrators with known, static IP addresses need to log in.
• ALWAYS ensure your own IP address is on the whitelist before enabling this feature.

XML-RPC is a legacy interface that allows remote connections. It is a primary target for brute-force attacks. We highly recommend disabling it unless you specifically use services that require it, such as the Jetpack app. If you use such services, do NOT add xmlrpc.php to your WAF rules, as this will block them.

It is extremely unlikely. This feature blocks unauthenticated access to the REST API endpoint that lists usernames. Legitimate plugins and themes almost never need to access this list publicly. The security benefit greatly outweighs the minimal risk.

This feature allows you to download a .json file of your plugin's configuration.

• Export Template (No API Keys): Safe to use as a starting point for other websites.
• Export Full Backup (With API Keys): Creates a complete backup for restoring on the same site. The Import function will overwrite your current settings. It is a secure process that only imports known plugin options.

1. Get reCAPTCHA keys from the Google reCAPTCHA Admin Console.
2. Go to Settings > Advanced IP Blocker.
3. In the "reCAPTCHA Protection" card, check "Enable reCAPTCHA".
4. Select the correct version (v2 or v3) and paste your Site Key and Secret Key.
5. Click "Save Changes".