GranTech IP Firewall for AbuseIPDB
| 开发者 | marcgran |
|---|---|
| 更新时间 | 2026年10月18日 17:28 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
GranTech IP Firewall for AbuseIPDB connects your WordPress installation to the community-driven AbuseIPDB database to automatically detect, block, and report abusive IP addresses before they can cause damage — now with a completely redesigned interface and proactive blacklist protection.
Key Features
- Real-time IP checks — Queries the AbuseIPDB API only on sensitive endpoints (wp-login.php, wp-admin, xmlrpc.php, comment submissions, and the JWT/users REST routes) and blocks IPs exceeding your abuse score threshold. Regular page views and front-end traffic never trigger an API call.
- Daily blacklist sync — Optionally downloads the 10,000 worst-reputation IPs once a day and blocks them instantly, without spending any check quota. Proactive protection before the first attack.
- Brute-force protection — Detects attacks on wp-login.php and XML-RPC and blocks the offending IP after N failed attempts.
- Automatic reporting — Reports attacking IPs to AbuseIPDB (Brute-Force + Web App Attack categories) with a fully customizable, privacy-safe public comment: your site URL and usernames are never exposed by default. Optionally reports comment spammers too (Blog Spam category) when a comment is marked as spam.
- False-positive protection — IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked.
- Vulnerability scan detection — Blocks IPs that request many non-existent pages in a short time, as scanners do when probing for files like /.env. No API quota used.
- Bot trap (honeypot) — A hidden link that people never see and robots.txt tells search engines to ignore; bots that follow it anyway are blocked.
- Username enumeration protection — Hides your usernames from anonymous visitors (?author=N, REST API users list, users sitemap, login error messages).
- Monitor mode — Try every protection safely: nothing is blocked or reported, and what would have been blocked is logged.
- Webhooks — Send blocks and attacks to n8n, Make, Zapier, Slack or Microsoft Teams, optionally signed with HMAC-SHA256.
- Tor blocking — Optionally block Tor exit nodes on sensitive endpoints regardless of score.
- Email alerts — Get notified when a brute-force attack is blocked (throttled to one email per attacking IP per hour).
- Redesigned admin interface — Modern dashboard with status hero, light & dark themes, API quota indicator, rich IP checker (usage type, distinct reporters, last report), 30-day activity chart and top offenders.
- Investigation tools — See the community's own reports behind any score, scan whole CIDR ranges for reported addresses, and withdraw your own reports if an IP was flagged by mistake.
- One-click actions — Block any IP straight from the event log or from a range scan; every IP links to its AbuseIPDB page for instant investigation.
- Dashboard widget — Key security stats at a glance on the main WordPress dashboard.
- Contributor badge — Display your AbuseIPDB contributor badge with the
[granipfi_badge]shortcode or a widget; sites that link to AbuseIPDB can request "supporter" status, which comes with higher daily API limits. - Event log — Full filterable history, with configurable retention period.
- Whitelist support — Exempt IPs or CIDR ranges (IPv4 and IPv6) from checks.
- Smart quota management — Response caching, automatic backoff when the daily quota is exhausted, and no API calls for trusted logged-in users.
- Reverse proxy support — Optional trusted-proxy mode for Cloudflare and load balancers (disabled by default to prevent IP spoofing).
- Accessibility — WCAG-conscious interface: AA contrast in both themes, keyboard navigation, screen reader support, reduced-motion and high-contrast modes.
- Once a day (optional), the plugin syncs the AbuseIPDB blacklist locally — the worst 10,000 IPs are blocked instantly with zero API cost.
- When any other IP accesses a sensitive endpoint (login, XML-RPC, comment submission), the plugin queries the AbuseIPDB API.
- If the abuse confidence score meets or exceeds your threshold (default 50/100), the IP is blocked automatically. Whitelisted crawlers like Googlebot are always allowed.
- If multiple failed login attempts are detected from the same IP, it is blocked and reported back to AbuseIPDB, and you can receive an email alert.
- Everything is recorded in a redesigned dashboard with real-time statistics.
安装:
- Upload the
grantech-ip-firewall-for-abuseipdbfolder to the/wp-content/plugins/directory. - Activate the plugin through the Plugins menu in WordPress.
- Go to IP Shield → Settings in the WordPress admin menu and paste your AbuseIPDB API key.
- Adjust the score threshold and brute-force parameters to suit your needs.
- Done — your site is now protected.
- Block threshold: 50 (blocks IPs with >50% abuse probability)
- Block duration: 24 hours
- Attempts before block: 5
- Time window: 10 minutes
- API cache: 60 minutes
- Report brute-force: Enabled
屏幕截图:
常见问题:
Do I need a paid AbuseIPDB account?
No. The free plan includes 1,000 checks per day, which is more than enough for most sites when the caching system is enabled.
Will it block legitimate users?
It is unlikely. The plugin only queries the API on sensitive endpoints, never on regular page views. IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked, and logged-in users with editing capabilities are skipped entirely, so you cannot lock yourself out of wp-admin. You can also add your own IPs or CIDR ranges to the plugin whitelist — recommended before activating.
What if my IP gets blocked?
You can log into the admin panel and remove the IP from IP Shield → Blocklist. If you cannot access the admin panel, add your IP to the whitelist directly in the database: UPDATE wp_options SET option_value = 'a:1:{i:0;s:X:"YOUR.IP.HERE";}' WHERE option_name = 'granipfi_whitelist';
Is it compatible with Cloudflare?
Yes. Enable the "Trust proxy headers" option in Settings and the plugin will read the CF-Connecting-IP header to obtain the real visitor IP. It is disabled by default for security (proxy headers can be spoofed on sites that are not behind a proxy).
Can I block IPs manually?
Yes. From IP Shield → Blocklist you can add any IP with a custom reason. Manual blocks are permanent by default.
How do I uninstall cleanly?
Deactivate and delete the plugin from the WordPress admin panel. All database tables (wp_abuseipdb_log, wp_abuseipdb_blocklist and wp_granipfi_blacklist) and options are removed automatically via uninstall.php.
For Developers
The plugin exposes the following hooks:
granipfi_report_comment(filter) — Modify the public comment sent to AbuseIPDB. Receives the comment, the targeted username and the attempt count.granipfi_block_message(filter) — Replace the HTML shown on the 403 block page.granipfi_brute_force_detected(action) — Fires when a brute-force attack is blocked. Receives the IP, username and attempt count.granipfi_access_denied(action) — Fires just before a request is denied. Receives the IP and the internal reason.granipfi_event_logged(action) — Fires after every security event is logged. Receives the IP, event name, score, country, ISP and JSON extra data.granipfi_comment_spam_report(filter) — Modify the public comment sent to AbuseIPDB for comment spam reports. Receives the text and the comment ID.
更新日志:
1.4.0
- New: Vulnerability scan detection — blocks IPs that trigger many 404 errors in a short time (configurable), ignoring missing images, styles and scripts. Uses no API quota.
- New: Bot trap (honeypot) — a hidden link, disallowed in robots.txt, that only bad bots follow.
- New: Username enumeration protection — blocks ?author=N, the REST API users list and the users sitemap for anonymous visitors, and makes login errors generic.
- New: Monitor mode — nothing is blocked or reported; every block that would have happened is logged as monitor_would_block. Clearly shown on the Dashboard.
- New: Webhooks in generic JSON, Slack or Microsoft Teams format, throttled and optionally signed (X-GranIPFI-Signature), with a "Send test message" button.
- New: Optional reporting of detected scanners (Web App Attack) and trapped bots (Bad Web Bot) to AbuseIPDB.
- New: granipfi_event_logged action for developers.
- New: Each bar of the activity chart now links to the event log filtered by that day, and the chart always shows the full 30 days (days without events included). The bars are keyboard and screen reader accessible.
- New: Date filter in the event log.
- Fix: Pagination in the event log no longer drops the active IP and event filters.
- Fix: The admin styles and scripts are now always refreshed after an update, instead of browsers or page caches serving an outdated copy.
- Safety: the new detections never block whitelisted IPs, logged-in editors, search engine crawlers or IPs on the official AbuseIPDB whitelist. All of them are off by default.
- Fix: The translations bundled with the plugin are now loaded as a fallback, so new strings appear translated immediately instead of in English until they are approved on translate.wordpress.org. Approved language packs from WordPress.org still take priority.
- Improvement: The "What's new" notice is shown only for new feature releases, not again after small maintenance updates.
- Accessibility: Light-theme text colours now meet WCAG AA contrast (links, IP addresses and status chips were below 4.5:1).
- Accessibility: Correct heading hierarchy on every admin page (h1 → h2 → h3, no skipped levels).
- Accessibility: The activity chart now has a text alternative for screen readers, and links that open a new tab announce it.
- Fix: The IP checker verdicts (High risk, Suspicious, Clean, Tor exit node) were hardcoded in English; they are now translatable, and their decorative icons are hidden from screen readers.
- Security hardening: Translated strings are now escaped before being inserted into the page by JavaScript.
- New: AbuseIPDB contributor badge — show it with the
[granipfi_badge]shortcode or the "AbuseIPDB Contributor Badge" widget. Sites that link to AbuseIPDB can request "supporter" status (with higher daily API limits) by contacting AbuseIPDB; it is not granted automatically. Fully opt-in: nothing is shown until you enter your user ID and place the shortcode or widget. - New: Opt-in reporting of comment spammers to AbuseIPDB (Blog Spam category). Only comments actually classified as spam are reported — on submission by an anti-spam filter such as Akismet, or when a moderator marks them as spam. Registered users and private IP ranges are never reported, and the comment text is never sent.
- Improvement: Login brute-force reports now use categories 18 + 21 (Brute-Force + Web App Attack), as AbuseIPDB recommends for attacks on WordPress.
- Improvement: Destructive actions (remove from blocklist, block a whole range, withdraw reports) now use accessible inline confirmations instead of native browser dialogs. This also removes the remaining inline JavaScript handlers and translates a confirmation message that was hardcoded in English.
- New: Catalan (ca) translation.
- New: The live IP checker now shows the evidence behind a score — the community's own recent reports (date, reporter country and comment) in a collapsible panel, plus the resolved hostnames.
- New: IP range scanner (Tools) — check a whole subnet against AbuseIPDB (up to /24 on the free plan), see every reported address sorted by score, and block them individually or all at once with a single button. Blocks respect your configured block duration, skip whitelisted IPs, and you stay on the scan results after blocking.
- New: "Withdraw my reports" tool — deletes the reports your own account submitted for an IP, useful when an address was reported by mistake (e.g. after a proxy misconfiguration).
- New: Configurable report history window (1-365 days, default 90) — lower values focus on currently active threats and reduce false positives.
- New: Configurable blacklist size (100-10,000 IPs) for the daily sync, so small hosting plans can keep the local table light.
- Fix: Removed the WooCommerce
wc-ajaxendpoint from firewall checks — store traffic no longer consumes API quota. - Fix: Readme accuracy — corrected the admin menu name (IP Shield), the full list of protected endpoints, and documented all four public hooks for developers.
- New: One-time dismissible "What's new" banner on the plugin Dashboard after each update, summarizing the highlights.
- New: Daily AbuseIPDB blacklist sync (opt-in) — downloads the worst-reputation IPs (up to 10,000) once a day into a local table and blocks them instantly on sensitive endpoints, without spending check quota.
- New: The official AbuseIPDB whitelist is now respected — whitelisted IPs (search engine crawlers, major CDNs) are never blocked, preventing false positives like blocking Googlebot.
- New: Richer live IP check — now shows usage type, domain, distinct reporters, last-reported date and whitelist/Tor badges.
- New: Completely redesigned admin interface — modern dual theme (light by default, dark via system preference), GranTech brand identity (teal + navy), status hero on the Dashboard, toggle switches, Dashicons instead of emojis, section navigation in Settings, and refined tables, cards and charts.
- Accessibility: All WCAG improvements preserved and extended — AA contrast verified in both themes, teal focus rings, forced-colors and reduced-motion support, 40px+ touch targets.
- Fix: Live IP check was broken by a JavaScript syntax error — now working again.
- Security: The AbuseIPDB API key is no longer printed in the Settings page HTML source; leave the field empty to keep the saved key.
- Security: Numeric settings are now clamped server-side (e.g. a score threshold of 0 — which would block every visitor — can no longer be saved).
- Fix: Multi-line report comment templates no longer lose their line breaks when saved.
- New: Option to block Tor exit nodes on sensitive endpoints (opt-in), using the isTor flag already returned by the AbuseIPDB API.
- New: AbuseIPDB daily API quota indicator on the Dashboard (remaining/limit with color coding), captured from the API response headers.
- New: Block button directly in the Event Log rows for one-click blocking of suspicious IPs.
- New: Configurable log retention period in Settings (default 90 days, minimum 7).
- Improvement: Automatic backoff when the daily API quota is exhausted (HTTP 429) — API checks pause until the quota resets at midnight UTC, keeping your site fast.
- Improvement: API check timeout reduced from 10s to 5s so visitors never wait long if AbuseIPDB is slow; reports keep the 10s timeout.
- Improvement: Authenticated users with editing capabilities are no longer checked against the API — saves quota and prevents locking yourself out of wp-admin.
- Improvement: Comment IP checks now require the real wp-comments-post.php endpoint, so unrelated forms with a "comment" field no longer trigger API calls.
- New: IP addresses in the Blocklist, Event Log and Dashboard are now clickable — they open the corresponding AbuseIPDB check page (abuseipdb.com/check/{IP}) in a new tab for quick investigation. (Thanks for the suggestion!)
- New: Option to report XML-RPC attacks to AbuseIPDB (opt-in) — IPs exceeding the failed-attempts limit via XML-RPC are reported with categories Brute-Force + Web App Attack, using a vector-specific privacy-safe comment.
- Fix: Added missing translators comments to email notification strings (plugin checker warnings).
- Security: IP detection no longer trusts proxy headers (X-Forwarded-For, CF-Connecting-IP) by default — prevents IP spoofing. New "Trust proxy headers" option for sites behind Cloudflare or a load balancer.
- Privacy: AbuseIPDB report comments no longer include the site URL or targeted username by default — reports are publicly visible on abuseipdb.com.
- New: Customizable report comment template in Settings with placeholders: {attempts}, {window}, {username}, {site}.
- New: granipfi_report_comment filter for developers to programmatically modify report comments.
- New: Email alerts — get notified when a brute-force attack is blocked (throttled to one per attacking IP per hour, configurable recipient).
- New: Dashboard widget — at-a-glance security stats on the main WordPress admin dashboard.
- Fix: "Repair database tables" button now works — the handler was never registered.
- Fix: CIDR whitelist now supports IPv6 ranges (previously IPv4-only).
- Fix: Cron cleanup is rescheduled automatically if it goes missing after a migration.
- Fix: Activation now records DB version to prevent unnecessary table recreation.
- Fix: Added missing event types (xmlrpc_blocked, xmlrpc_probe, report_failed) to the event log filter and styles.
- Fix: Spanish (es_ES) translation completed and aligned with the official WordPress.org es_ES glossary (informar, malintencionado, avisos, Escritorio, ajustes, caduca…).
- Performance: is_blocked() result cached per-IP for 60 seconds — avoids a DB query on every request.
- Performance: Dashboard statistics cached for 5 minutes — avoids 3 heavy GROUP BY queries on every page load.
- Fix: Removed .gitignore file not permitted in WordPress.org plugin repository.
- i18n: Full internationalization — all admin view strings wrapped in __() translation functions.
- i18n: Plugin now displays correctly in any WordPress language based on site settings.
- i18n: English as source language; Spanish (es_ES) loaded automatically via .mo file.
- Fix: Removed remaining hardcoded Spanish strings from all admin views.
- Fix: CSS prefix updated — all classes renamed from shield- to granipfi-.
- Fix: JS global object renamed from AbuseIPDBShield to GranIPFI.
- Fix: Blocklist page showing empty despite IPs being blocked — fixed by adding automatic DB table creation/repair on every plugin load.
- Fix: Added DB version check (granipfi_db_version) to ensure tables are always present and up to date after updates or migrations.
- Improvement: Added database repair tool in Settings page for manual recovery.
- Fix: Admin panel title text color now correctly displays white on dark background.
- Accessibility: Added aria-hidden="true" to all decorative dashicons.
- Accessibility: Added scope="col" to all table header cells (17 instances).
- Accessibility: Added aria-label to all data tables.
- Accessibility: Added aria-live="polite" and aria-atomic to AJAX result region.
- Accessibility: Added role="status" to success notices and role="alert" to error notices.
- Accessibility: Added aria-busy state to Verify IP button during async requests.
- Accessibility: Replaced with on IP check input field.
- Accessibility: Added for= attribute to filter labels in event log.
- Accessibility: Added aria-describedby to all settings form fields.
- Accessibility: All font sizes increased to minimum 12px (previously 10-11px).
- Accessibility: Removed outline:none from focus states — now shows visible 2px blue outline.
- Accessibility: Fixed focus-visible selector pointing to non-existent .shield-field class.
- Accessibility: Added focus and focus-visible styles for all interactive elements.
- Accessibility: Added border to score badges and event chips (non-color visual cue, WCAG 1.4.1).
- Accessibility: Added text-decoration:underline to pagination links (WCAG 1.4.1).
- Accessibility: Improved color contrast ratio of muted text: #8b949e → #a0aab8 (~5.2:1).
- Accessibility: Added prefers-reduced-motion support — disables transitions/animations.
- Accessibility: Added forced-colors (Windows High Contrast) support with borders and forced-color-adjust.
- Accessibility: Added minimum touch target size 44x44px to buttons and pagination links (WCAG 2.5.8).
- Accessibility: Added screen-reader-text utility class (WordPress standard).
- Initial release.
- Real-time IP checks against the AbuseIPDB v2 API.
- Automatic blocking based on configurable score threshold.
- Brute-force protection for wp-login.php and XML-RPC.
- Automatic reporting of aggressive IPs to AbuseIPDB.
- Admin dashboard with statistics and activity chart.
- Event log with filters.
- Manual blocklist with configurable expiry.
- Whitelist with CIDR range support.
- API response caching via WordPress transients.
- Cloudflare and reverse proxy support.
- Spanish (es_ES) translation included.