开发者 | darkog |
---|---|
更新时间 | 2024年9月24日 23:01 |
PHP版本: | 3.7 及以上 |
WordPress版本: | 6.6 |
版权: | GPLv3 |
版权网址: | 版权信息 |
wp-comments-post.php
, xmlrpc.php
, wp-login.php
, wp-signup.php
, wp-admin/admin.php
, wp-admin/admin-ajax.php
, wp-admin/admin-post.php
will be validated by means of a country code based on IP address. It allows you to configure either whitelist or blacklist to specify the countires, CIDR notation for a range of IP addresses and AS number for a group of IP networks.wp-admin/*.php
, plugins/*.php
and themes/*.php
even from the permitted countries. It will protect your site against certain types of attack such as CSRF, LFI, SQLi, XSS and so on, even if you have some vulnerable plugins and themes in your site.wp-config.php
or uploading malwares via vulnerable plugins/themes can be blocked.403 Forbidden
to deny access pages, 404 Not Found
to hide pages or even 200 OK
to redirect to the top page.
You can also have a human friendly page (like 404.php
) in your parent/child theme template directory to fit your site design.add_filter()
with pre-defined filter hook. See various use cases in samples.php bundled within this package.
You can also get the extension IP Geo Allow by Dragan. It makes admin screens strictly private with more flexible way than specifying IP addresses.rel=nofollow
had no longer be attached to the links in comment_content
. This change prevents to block "Server Side Request Forgeries" (not Cross Site but a malicious internal link in the comment field).This plugin is designed based on the principle of "Privacy by design" so that you can compliantly run it to GDPR. As guarding against personal data breach, IP addresses in this plugin are encrypted and also can be anonymized by default. It also provides some functions not only to manually erase them but also to automatically remove them when those are exceeded a certain amount/time. However, these are the part of GDPR requirements and do not guarantee that the site is compliant with GDPR. Refer to 3.0.11 release note for details. = Is there a way to migrate from IP Geo Block" Yes, if "IP Geo Block" settings are detected, you will see migrate option in the Settings last in "Plugin Settings" section. This will copy the settings from "IP Geo Block" only.
Yes. You can synchronize the settings with all the sites on the network when you activate on network and enable "Network wide settings" in "Plugin settings" section. = Does this plugin allows blocking US States, Country Regions or Cities? Yes. Please view City/State Level Matching for more details.
The short answer is YES, especially for the purpose of security e.g. blocking malicious access both on the back-end and on the front-end. You can find the long answer and the compatibility list of cache plugins at "Compatibility with cache plugins".
Absolutely, YES. Sometimes, a WordFence Security user would report this type of claim when he/she found some accesses in its Live traffic view. But please don't worry. Before WordPress runs, WordFence cleverly filters out malicious requests to your site using auto_prepend_file directive to include PHP based Web Application Firewall. Then this plugin validates the rest of the requests that pass over Wordfence because those were not in WAF rules, especially you enables "Prevent Zero-day Exploit". It would also possibly be caused by the accuracy of country code in the geolocation databases. Actually, there is a case that a same IP address has different country code. For more detail, please refer to "I still have access from blacklisted country.".
The easiest way is to use free proxy browser addon.
Another one is to use http header browser addon.
You can add an IP address to the X-Forwarded-For
header to emulate the access behind the proxy. In this case, you should add HTTP_X_FORWARDED_FOR
into the "$_SERVER keys for extra IPs" on "Settings" tab.
See more details at "How to test prevention of attacks".
Please find the solution in Quick recovery from blocking on your login page at first.
You can also find another solution by editing "Emergent Functionality" code section near the bottom of ip-location-block.php
. This code block can be activated by replacing /*
(opening multi-line comment) at the top of the line to //
(single line comment), or *
at the end of the line to */
(closing multi-line comment).
`/**
/wp-content/plugins/ip-location-block/
on your server via FTP, you become to be able to login again as an admin.
Remember that you should upload the original one after re-configuration to deactivate this feature.
This document can also help you.
Yes. Roughly speaking, the strategy of this plugin has been constructed as follows:
Unfortunately, no. This plugin can't handle the requests that are not parsed by WordPress. In other words, a standalone file (PHP, CGI or something executable) that is unrelated to WordPress can't be validated by this plugin even if it is in the WordPress install directory. But there's exceptions: When you enable "Force to load WP core" for Plugins area or Themes area, a standalone PHP file becomes to be able to be blocked. Sometimes this kind of file has some vulnerabilities. This function protects your site against such a case.
If you encounter this message, please refer to this document to resolve your blocking issue. If you can't solve your issue, please let me know about it on the support forum. Your logs in this plugin and "Installation information" at "Plugin settings" will be a great help to resolve the issue.
Check the "Admin ajax/post" option in "Back-end target settings", either disable it or whitelist the required Ajax actions.
When you enable "Force to load WP core" options, this plugin will try to configure .htaccess
in your /wp-content/plugins/
and /wp-content/themes/
directory in order to protect your site against the malicious attacks to the OMG plugins and themes.
But some servers doesn't give read / write permission against .htaccess
to WordPress. In this case, you can configure .htaccess
files by your own hand instead of enabling "Force to load WP core" options.
Please refer to "How can I fix permission troubles?" in order to fix this error.