Invalid Traffic Blocker
| 开发者 | maocular |
|---|---|
| 更新时间 | 2026年10月26日 17:14 |
| PHP版本: | 7.2 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
安装:
- Upload the plugin files to the
/wp-content/plugins/invalid-traffic-blockerdirectory or install the plugin through the WordPress plugins screen. - Activate the plugin through the 'Plugins' screen in WordPress.
- Navigate to
Settings > Invalid Traffic Blockerin your WordPress admin dashboard. - Enter your IPHub API key, choose your desired blocking mode, and add any trusted IP addresses to the whitelist.
- Save your settings and use the "Test API Connectivity" and "Whitelist My IP" buttons as needed.
屏幕截图:
常见问题:
What is Invalid Traffic Blocker?
Invalid Traffic Blocker is a WordPress plugin that uses the IPHub.info API to detect and block unwanted traffic, including bots, VPNs, and suspicious IP addresses. It helps ensure that only valid traffic reaches your website.
How do I configure the plugin?
After activating the plugin, go to Settings > Invalid Traffic Blocker. Here you can enter your API key, select a blocking mode, and manage your IP whitelist.
What if my API key is missing or invalid?
If the API key is missing or incorrect, the plugin will not perform any blocking. Make sure to obtain a valid API key from IPHub.info.
Can I update the whitelist later?
Yes, you can update the list of whitelisted IP addresses at any time from the settings page.
How do I whitelist my IP?
Click the "Whitelist My IP" button on the settings page to add your current IP address to the whitelist, then click "Save Changes".
My site is behind Cloudflare, a CDN or a proxy. Which Visitor IP Source should I use?
Leave it on "Automatic" if you use Cloudflare, or a proxy on your own server or private network. If requests reach your site through another CDN, firewall or load balancer that adds an X-Forwarded-For header, choose "Reverse proxy or load balancer". The settings page shows which IP the plugin sees for your own request, so you can check that it matches your real IP.
Can a bot get past the blocker by pretending to be Googlebot?
No. With "Allow Known Crawlers" enabled, Googlebot, Bingbot, Yahoo Slurp, Baiduspider and YandexBot are confirmed with a reverse DNS lookup. A visitor who only fakes the User-Agent is checked like everyone else. Patterns you add under "Additional Crawler Patterns" are not verified, so only add crawlers you need.
更新日志:
- Refreshed the settings page with responsive sections, saved configuration status, a masked API key, inline whitelist feedback, and API test loading/error states. Assets are local and load only on the plugin settings page.
- Added clear IPHub data-sharing guidance beside setup. Existing option names and visitor blocking behavior are preserved.
- Security: The visitor IP is now read from the direct connection. Proxy headers (X-Forwarded-For, CF-Connecting-IP) are only trusted when the request comes from Cloudflare or a private network address, or when you choose them in the new "Visitor IP Source" setting. Previously any visitor could fake their IP to skip the check or use up your API quota.
- Security: "Allow Known Crawlers" now confirms crawlers with a reverse DNS lookup, so a faked crawler User-Agent no longer skips the check. DuckDuckBot was removed from the built-in list because it can't be verified this way; add it under "Additional Crawler Patterns" if you need it.
- Security: IPHub API requests now use HTTPS, so your API key and visitor IPs are no longer sent in plain text.
- Fix: The first save of the settings could reset them to Safe Mode, turn on "Allow Known Crawlers" and show a "Please select only one blocking mode" error.
- Fix: "Allow Known Crawlers" never matched on hosts that run PHP as CGI/FastCGI.
- Fix: WP-Cron, WP-CLI and the login page are no longer checked, so scheduled tasks keep running and admins on a VPN can still sign in.
- Fix: When the IPHub API fails or rate-limits requests, lookups pause for 5 minutes instead of slowing down every page view.
- Change: "Additional Crawler Patterns" are now plain-text, case-insensitive matches instead of regular expressions. Patterns containing "/" used to cause PHP warnings on every page. Remove regex symbols such as ^ or $ from existing entries.
- Change: The blocking mode is now a single choice with Safe Mode as the default. Sites that had the plugin enabled with no mode ticked now block in Safe Mode. Custom Mode with no block types ticked no longer makes API calls.
- The settings page shows which IP the plugin sees for your request, and warns when proxy headers are being ignored.
- Added a link to IVTB, the enterprise version for non-WordPress sites, on the settings page and the Plugins screen.
- Tested up to WordPress 7.1.
- Added “Allow Known Crawlers” setting to automatically bypass IP checks for common search engine bots (Googlebot, Bingbot, Slurp, DuckDuckBot, Baiduspider, YandexBot).
- Introduced “Additional Crawler Patterns” textarea so admins can specify extra User-Agent regexes to whitelist.
- Updated
invatrbl_check_visitor_ip()to usefilter_input()andsanitize_text_field()when reading$_SERVER['HTTP_USER_AGENT']to comply with WP security standards. - Ensured User-Agent checks are fully sanitized to eliminate any
InputNotSanitizedwarnings during plugin review. - Streamlined front-end blocking logic so known crawlers (built-in or custom) are skipped before performing IPHub API lookups.
- Minor code refactoring and cleanup to align with WordPress Plugin Coding Standards.
- Use admin’s current IP for API testing instead of a default.
- Fancy info boxes for API test responses (green for success, red for errors).
- "Whitelist My IP" button to add the admin's current IP to the whitelist automatically.
- added whitelist functionality and basic API connectivity testing.
- introduced multiple blocking modes.
- Initial release with core functionality:
- Integration with IPHub.info API.
- Multiple blocking modes: Safe, Strict, and Custom.
- Persistent warning message for blocked users.
- Basic security measures and caching implementation.