Deerwood Country Access
| 开发者 | williamqlee |
|---|---|
| 更新时间 | 2026年10月1日 02:38 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Deerwood Country Access makes geographic access control easy to manage from WordPress.
Choose which countries may access your site, detect and rate-limit repeat offenders, and optionally connect Cloudflare with a one-click OAuth authorization so unwanted traffic can be stopped at the edge before it reaches WordPress.
New installations are preconfigured for "Allow selected countries only" with Canada and the United States selected. Protection remains OFF until an administrator enables it.
Highlights
- Allow selected countries only, or block selected countries.
- Canada + United States preselected for new installations.
- Cloudflare
CF-IPCountrydetection when available. - Optional cached IP geolocation fallback when Cloudflare country headers are unavailable; this external lookup is OFF by default.
- Smart rate limiting for blocked traffic and common malicious probe paths.
- Local blocked-request logging with configurable retention.
- Repeat-offender reporting and one-click Cloudflare edge blocking.
- One-click Cloudflare OAuth connection; site owners do not create or paste API tokens.
- A single managed Cloudflare custom WAF rule for both geographic access and repeat offenders.
- Country rule changes update the existing Cloudflare rule instead of creating new rules.
- Administrator country/IP anti-lockout protections.
- Trusted IP exceptions.
- Optional 30-minute administrator safety window when an edge rule changes.
- Cloudflare-verified search engines and trusted bots such as Googlebot and Bingbot can be allowed through.
- Optional protection for the frontend, login, wp-admin, XML-RPC, and REST API.
- Cloudflare connection testing, diagnostics, safe disconnect, and stale-connection recovery.
安装:
- Install and activate Country Access.
- Open Settings > Country Access.
- Review the preselected Canada + United States allow-only profile and make sure your own country is allowed.
- Review the administrator safety window and trusted IP options before enabling protection.
- Turn Country Access ON only when you are ready to enforce the policy.
- Optional: click Connect Cloudflare to move supported country and repeat-offender blocking to Cloudflare's edge.
- After changing country or Cloudflare settings, test the site before ending your administrator session so you do not accidentally lock yourself out.
常见问题:
Do I need Cloudflare?
No. Deerwood Country Access works without Cloudflare. Its optional IPWhois geolocation fallback can be enabled by the administrator when a Cloudflare country header is unavailable. The external fallback is OFF by default. Connecting Cloudflare allows Country Access to maintain an edge WAF rule so supported unwanted traffic can be blocked before it reaches your web server.
Does protection turn on immediately after activation?
No. New installations start with Canada and the United States selected in Allow Only mode, but Country Access remains OFF until an administrator enables it.
Does Country Access use one Cloudflare rule per IP or country?
No. Country Access maintains a single custom WAF rule named Country Access: Protection. Geographic restrictions and managed repeat-offender IPs are combined into that rule and updated in place. Country Access does not intentionally modify or delete unrelated Cloudflare rules.
What happens if the Cloudflare custom-rule limit is reached?
Country Access leaves unrelated Cloudflare rules untouched. Local WordPress protection continues to operate and the administrator is shown the Cloudflare error.
Can Country Access accidentally block the administrator?
Country Access includes multiple safeguards. It checks the administrator's current country before syncing risky geographic settings, supports trusted IPs, and can temporarily exempt the current administrator IP for 30 minutes while an edge rule is changed.
What about Googlebot and other search engines?
The Cloudflare settings include Allow verified search engines and trusted bots, enabled by default. When enabled, Country Access uses Cloudflare's verified cf.client.bot signal so known good crawlers such as Googlebot and Bingbot can bypass the Country Access edge rule.
Country Access does not trust a visitor simply because its User-Agent says "Googlebot".
Does rate limiting apply to all visitors?
No. The built-in rate limiter focuses on country-blocked traffic and suspicious probe paths. High-risk requests such as .env, .git, wp-config, and phpMyAdmin probes receive higher weights.
Why can the WordPress activity log be quiet after Cloudflare protection is enabled?
Traffic blocked at Cloudflare's edge never reaches WordPress, so Country Access cannot record those requests in its local WordPress log. This is expected and reduces load on the origin server.
更新日志:
1.0.11
- Fixed Cloudflare OAuth authorization to request offline_access so Cloudflare issues a refresh token.
- Added automatic OAuth access-token renewal using the stored refresh token, including rotated refresh-token handling.
- Added one automatic refresh-and-retry when Cloudflare unexpectedly returns HTTP 401.
- Improved Cloudflare rule-status handling so API/authentication failures are not incorrectly reported as a missing managed rule.
- Narrowed the verified-bot edge exception to Cloudflare-verified Google and Bing crawlers.
- Added a warning when edge sync is enabled but the current request appears to bypass Cloudflare.
- Added WordPress-layer direct-origin bypass protection when Cloudflare edge sync is active.
- Added PHP CLI safety bypass so maintenance scripts that bootstrap WordPress are not blocked by Country Access.
- Verified the full OAuth lifecycle in production testing: authorization, refresh-token issuance, forced access-token expiry, automatic renewal, and continued Cloudflare API access.
- Added automatic WordPress-layer origin bypass protection when Country Access and Cloudflare country sync are enabled.
- Requests that reach WordPress without Cloudflare request markers are blocked with HTTP 403 instead of bypassing the configured edge policy.
- Logged-in administrators, trusted IPs, the detected origin server IP, WP-CLI, and WordPress cron retain their existing safety bypasses.
- This portable WordPress safeguard complements, but does not replace, server/firewall origin lockdown.
- Fixed Cloudflare OAuth renewal so a known-expired access token is never reused after refresh fails.
- Added one automatic refresh-and-retry when Cloudflare unexpectedly returns HTTP 401.
- Improved Cloudflare rule status so authentication/API failures display as unable to verify instead of incorrectly reporting the managed rule as missing.
- Narrowed the verified-bot edge exception to Cloudflare-verified Google and Bing crawlers; other verified crawlers now follow the configured country policy.
- Added an administrator warning when Cloudflare edge sync is enabled but the current request appears to be bypassing Cloudflare.
- Updated internal prefixes for WordPress.org directory compatibility and collision avoidance.
- Preserved existing settings and Cloudflare connection data during the prefix migration.
- Added automatic protection for the WordPress origin server's public IP when it can be safely detected.
- The origin server IP now bypasses local Country Access blocking and rate limiting.
- Cloudflare geographic, repeat-offender, and manual blacklist protection will not block the detected origin server IP.
- The diagnostics panel shows the detected WordPress server IP as Protected.
- Added an unsaved-settings safeguard to the Country Access admin screen.
- A sticky Save Changes reminder appears after settings are modified.
- Leaving or refreshing the page with unsaved changes now triggers a warning.
- Saving clears the warning normally.
- Added a manual IP blacklist alongside the existing whitelist.
- Blacklisted IPs are blocked locally even when their country is otherwise allowed.
- When Cloudflare sync is active, manual blacklist IPs are folded into the existing single Country Access: Protection rule.
- Whitelisted IPs take priority over manual blacklist and managed repeat-offender IPs.
- Explicit manual blacklist entries remain blocked even when verified-bot bypass is enabled.
- Corrected the View rules in Cloudflare link to Cloudflare's current zone Security Rules route (/security/security-rules).
- Fixed the View rules in Cloudflare link to open the zone Security page used by Cloudflare's current dashboard.
- The link now targets /security/ instead of the obsolete /security/rules path.
- Fixed the master ON/OFF control after the 1.0.1 settings-save safeguard.
- Normal Save Settings actions continue to preserve the master protection state.
- The dedicated master switch can now explicitly change the enabled state without the settings sanitizer reverting it.
- Corrected two remaining admin links to the Deerwood Country Access settings slug.
- Fixed a settings-save bug where saving the main settings form could turn off the master Country Access protection switch and remove the managed Cloudflare rule.
- The master protection state is now preserved when saving unrelated settings.
- Initial public release.
- WordPress.org compliance pass: text domain, prepared custom-table queries, escaping, sanitization, nonces/OAuth state documentation, and redirect safety.
- Country allow-only and block-selected modes.
- Cloudflare-aware country detection with cached IP geolocation fallback.
- Smart rate limiting and repeat-offender reporting.
- One-click Cloudflare OAuth authorization.
- Single managed Cloudflare WAF rule combining geographic and repeat-offender protection.
- One-click offender edge blocking and removal.
- Administrator anti-lockout and trusted-IP safeguards.
- Verified Cloudflare bot/search-engine bypass option.
- Safe Cloudflare disconnect, reconnect, and stale OAuth recovery.
- Cloudflare API burst protection and graceful HTTP 429 handling.
- Local security logging with configurable retention.