GranTech IP Firewall for AbuseIPDB

No. The free plan includes 1,000 checks per day, which is more than enough for most sites when the caching system is enabled.

It is unlikely. The plugin only queries the API on sensitive endpoints, never on regular page views. IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked, and logged-in users with editing capabilities are skipped entirely, so you cannot lock yourself out of wp-admin. You can also add your own IPs or CIDR ranges to the plugin whitelist — recommended before activating.

You can log into the admin panel and remove the IP from IP Shield → Blocklist. If you cannot access the admin panel, add your IP to the whitelist directly in the database: UPDATE wp_options SET option_value = 'a:1:{i:0;s:X:"YOUR.IP.HERE";}' WHERE option_name = 'granipfi_whitelist';

Yes. Enable the "Trust proxy headers" option in Settings and the plugin will read the CF-Connecting-IP header to obtain the real visitor IP. It is disabled by default for security (proxy headers can be spoofed on sites that are not behind a proxy).

Yes. From IP Shield → Blocklist you can add any IP with a custom reason. Manual blocks are permanent by default.

Deactivate and delete the plugin from the WordPress admin panel. All database tables (wp_abuseipdb_log, wp_abuseipdb_blocklist and wp_granipfi_blacklist) and options are removed automatically via uninstall.php.

The plugin exposes the following hooks:

• granipfi_report_comment (filter) — Modify the public comment sent to AbuseIPDB. Receives the comment, the targeted username and the attempt count.
• granipfi_block_message (filter) — Replace the HTML shown on the 403 block page.
• granipfi_brute_force_detected (action) — Fires when a brute-force attack is blocked. Receives the IP, username and attempt count.
• granipfi_access_denied (action) — Fires just before a request is denied. Receives the IP and the internal reason.