Mcpelee Site Security Guard

Mcpelee Site Security Guard provides access control and security monitoring through Settings > Mcpelee Site Security Guard. The dashboard includes IP blocking, security settings, file scanning, and logs. The administration interface is currently in Korean. Features

• IPv4, IPv6, and CIDR block and allow lists.
• Apache-compatible redirects to a static error page before WordPress runs.
• A 24-hour cache policy for the static page; IP-dependent redirects use private, no-store.
• Country blocking with country allow exceptions using server-provided GeoIP information.
• Temporary login failure limits, security headers, optional XML-RPC blocking, and REST user lookup restrictions.
• Optional access logs and country lookup, sorting, clickable filters, and per-administrator preferences.
• SHA-256 file change monitoring and optional daily scans through WP-Cron.

Server requirements WordPress 6.0 or later, PHP 8.0 or later, and a single-site installation are required. Server-level blocking requires Apache 2.4 with mod_rewrite, mod_headers, AllowOverride FileInfo, or a compatible LiteSpeed configuration. The site home .htaccess, the rewrite root returned by get_home_path(), must be writable. Saving the IP policy generates both blocking and static-page header rules in a plugin-managed section. No hidden .htaccess file is shipped inside the plugin. Nginx and the PHP development server do not process .htaccess. PHP fallback protection applies to WordPress requests, not every static file. A CDN that serves responses before reaching the origin needs its own access rules. Trusted proxies must restore the real client IP at the server level. Country blocking requires a server GeoIP module and database providing MM_COUNTRY_CODE or GEOIP_COUNTRY_CODE before rewrite processing. The plugin does not install these dependencies. Requests with unknown countries are not country-blocked. IP allow rules take priority over IP block rules, followed by country allow exceptions and country blocks. A country allow list is not an exclusive list of permitted countries. Storage and retention Optional access logs store the IP, request method, URL path, and response status. Query strings, request bodies, passwords, and cookies are not logged. Sensitive data embedded in URL paths may still be recorded. Access logging adds one database write per WordPress request. Requests blocked by the web server are available in server logs, not plugin logs. Logs default to seven days of retention, configurable from 1 to 90 days. Hourly cleanup retains at most 20,000 recent records; the count can exceed this between cleanup runs. File scans store paths and hashes, not original file contents. Detected changes are investigation clues, not proof of intrusion or a malware diagnosis. Deactivation removes the plugin-managed server rules and scheduled tasks. Settings, logs, country cache, file baselines, and administrator preferences remain in the database after deactivation or deletion. Distribution and compatibility Classes and constants use MCPELEE_SSG_; hooks, options, caches, and database tables use mcpelee_ssg_. Internal filenames and CSS identifiers use mcpelee-ssg-. Legacy development identifiers are recognized only for migration or compatibility. Standard WordPress filenames, the main plugin filename, and the static error page URL remain stable. Developer tests and build scripts are excluded from the release ZIP. No custom Update URI header is used.

1. Upload the release ZIP using Plugins > Add New, or copy its mcpelee-site-security-guard folder into wp-content/plugins.
2. Activate Mcpelee Site Security Guard.
3. Open Settings > Mcpelee Site Security Guard and add your fixed administrator IP to the IP allow list.
4. Enter blocked IPs or CIDRs and save the IP/country policy to apply server rules.
5. Verify redirects from an actual blocked IP and normal access from an allowed IP.
6. Run the first file scan to establish a baseline, then enable the desired security, logging, and scheduled scan options.

When replacing a development build, back up files and the database first. Replace the entire plugin folder so obsolete files, including tests, do not remain. Development-table migration requires database permission to rename tables. Older MU-plugin loaders must be removed before activating this plugin.

1.1.0

• Default the initial log view to suspicious requests, with an explicit opt-out. Display saved selected countries first in each block/allow list.
• Bulk IP registration includes Korean and allowlisted IPs and preserves allowlist priority. Current administrator IP and already blocked IPs (including CIDR coverage) are excluded from the preview and target count. Bulk country registration excludes configured allowed countries; KR is eligible unless allowlisted.
• Added bulk blocking from the complete suspicious-filter result with a target preview and stale-preview protection. Current administrator IP and already blocked IPs are excluded from IP registration; allowlisted IPs remain visible. Country registration excludes allowed, already blocked and unknown/expired countries and preserves the country-blocking switch.
• Added suspicious access-request filtering with visible reasons, including user enumeration, network admin probes, sensitive files, web shells and traversal patterns. Classification is advisory, not proof of an attack.
• Added numbered log pages and filtered record totals. Existing logs are classified without a database migration.

1.0.0

• Initial release with IP/country access rules, static error redirects, login protection, file monitoring, and security logs.
• Log filtering, sorting, country enrichment, and per-administrator IP exclusion preferences.
• WordPress.org distribution metadata and runtime-only packaging.