SentraIP
| 开发者 | moveforwardltd |
|---|---|
| 更新时间 | 2026年9月11日 05:50 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
SentraIP filters unwanted visitors before they reach your WordPress application layer. Blocking runs on the WordPress
init hook, before your theme and most plugins load, and every lookup is performed locally against offline MMDB database files in your uploads directory — so no external request is made on normal page loads.
The plugin is free and open source (GPLv2 or later), maintained by Move Forward Limited. It works out of the box and no account and no paid plan is ever required to use it.
What it blocks
- Country (geolocation) blocking — block visitors by country. You download a free IP-to-country database from a provider of your choice (DB-IP, MaxMind GeoLite2 or IP2Location LITE); your own admin country and your server's country are excluded automatically so you never lock yourself out.
- Bot blocking — block well-known crawlers, scanners and attack tools (Googlebot, GPTBot, SemrushBot, AhrefsBot, ClaudeBot and many more) by User-Agent. Requests with an empty or missing User-Agent can also be blocked.
- Spam-comment IP blocking — IPs from comments marked as spam (manually, by bulk action, or by Akismet) are blocked automatically for 24 hours. This needs no external data at all.
- Free SPAM reputation dataset (opt-in) — optionally download a free SPAM IP reputation database to block known spam sources. Entirely opt-in, no account required.
- IP whitelist — approved IPs and CIDR ranges are never blocked, so you can always guarantee your own access.
- Statistics & Blockable Traffic insights — see what was blocked over time, and see allowed traffic that matched a dataset so you can decide what to start filtering.
- Blocker Simulator — test what the blocker would do for any IP / User-Agent, without blocking anything.
- Configurable response — return 403, 404, 410, 444 or 503 for blocked requests.
- Proxy-aware — behind Cloudflare or a reverse proxy, enable "Trust Proxy Headers" so the real visitor IP is used for every check.
- Lockout-safe by design — the WordPress admin (
/wp-admin),/wp-login.phpand/wp-register.phpare never blocked, logged-in users are never blocked, and an emergency kill switch (WP_SENTRAIP_DISABLE_BLOCKING) can disable all blocking fromwp-config.php. - Secure storage — database files live in a protected uploads subdirectory guarded by
.htaccessandindex.php.
安装:
- In your WordPress admin go to Plugins → Add New → Upload Plugin.
- Choose the
sentraip.zipfile and click Install Now, then Activate. - Open SentraIP → Geolocation, choose a free IP-to-country provider (DB-IP needs no account) and download the database.
- Configure your blocking rules under Countries and Bots, and the master switches under Settings → Blocking Controls.
- (Optional) On SentraIP → Settings, enable the free SPAM reputation dataset.
sentraip folder into /wp-content/plugins/ and activate it from the Plugins menu.
Requirements: PHP 7.4+ and WordPress 6.8+. IP lookups use the MaxMind DB reader, which is bundled with the plugin.屏幕截图:
常见问题:
Is the plugin free? Do I need an account?
The plugin is free and open source (GPLv2 or later) and fully functional on its own. Country blocking, bot blocking (with a large built-in list), automatic spam-comment IP blocking, the IP whitelist and the opt-in free SPAM reputation dataset all work with no account at all. Additional IP-reputation datasets (VPN, TOR, PROXY, THREAT, Datacenter and composed rules) are available through the separate SentraIP PRO companion plugin, which connects to a SentraIP account — but this free plugin never requires it.
Will this block my own access?
No. The plugin auto-excludes your server's country and your saved admin country. The WordPress admin area, the login page (/wp-login.php) and the registration page are never blocked, and logged-in users are never blocked — so you can always sign in and fix a rule. As a last resort you can add define( 'WP_SENTRAIP_DISABLE_BLOCKING', true ); to wp-config.php to disable all blocking.
What happens if the database files are not downloaded yet?
The plugin gracefully skips any check whose database file is missing. Your site keeps working normally until the files are available.
Does the plugin make external requests on every page load?
No. All IP lookups run against local binary database files in your uploads directory. External connections are made only when downloading or refreshing a database file (on a monthly schedule, or when you trigger it manually) — the geolocation database, or the opt-in free SPAM dataset.
Where are the database files stored?
In wp-content/uploads/wp-sentraip/. The directory is protected by a .htaccess (Deny from all) and an index.php to prevent direct web access.
Does it support IPv6?
Yes. The plugin detects whether the visitor's IP is IPv4 or IPv6 and uses the matching database file, when that version is available for the dataset.
What is the spam comment IP blocking?
When a comment is marked as spam, the commenter's IP is recorded and blocked for 24 hours. This works entirely locally, with no external data or account.
How do I recover if a rule locks me out?
Open /wp-login.php and sign in — login and /wp-admin are never blocked. Then edit the rule that caught you and remove your country/datacenter/IP. If you cannot reach the admin at all, add define( 'WP_SENTRAIP_DISABLE_BLOCKING', true ); to wp-config.php.
更新日志:
1.1.6
- All statistics features now work for everyone: the configurable retention, the "Clear all statistics" reset, the full CSV export and the high-rate non-blocked traffic view are no longer restricted — they record and run locally on your own site, so they are part of the free plugin.
- Fixed the Privacy Policy and Terms links and the third-party provider links in the readme, which pointed to pages that returned a 404.
- SentraIP can now reliably read the spam-comment IP feed even if its own address happens to be on the site's blocklist: requests genuinely signed by SentraIP (Ed25519, verified against a public key fetched from the service and cached) bypass the block and authorise the feed endpoint. Works with or without a SentraIP account.
- Added an explicit opt-in (Settings → Security) to share the IPs of comments you mark as spam with SentraIP to improve protection for everyone. It is off by default; with it disabled nothing is shared and the feed endpoint refuses all requests.
- Statistics: the Blockable-Traffic timeline query now passes its LIKE pattern through a bound parameter (esc_like), completing the prepared-SQL hardening. No functional change.
- Statistics queries now use $wpdb->prepare() with the %i identifier placeholder for table names, fully parameterising every custom query (WordPress.org prepared-SQL compliance). No functional change.
- WordPress.org coding-standards compliance: replaced discouraged filesystem calls with the WordPress APIs (wp_delete_file(), WP_Filesystem::move()), replaced mt_rand() with wp_rand(), sanitized all request input inline, prefixed uninstall globals, and audited the statistics table queries. No functional change.
- Fixed the Statistics hourly drill-down (click a day bar) always showing "No data": the hourly rows were matched against formatted "HH:00" labels instead of the raw hour numbers stored in the database, so no bar was ever drawn.
- The daily chart/insights cache is now fully cleared on update (including the per-day drill-down entries), so a plugin update never serves data built by the previous version.
- Tested up to WordPress 7.1.
- SentraIP is now a standalone free plugin: it blocks by country, known bots and custom User-Agent strings, spam-comment IPs (24h), and an opt-in free SPAM reputation dataset — no account required. The paid datasets (VPN, TOR, PROXY, THREAT, Datacenter and composed rules) moved to the separate SentraIP PRO add-on.
- Free SPAM dataset: the download now succeeds when the IPv4 file is fetched (the dataset is published as IPv4-only); a missing per-version file is treated as "not published yet" instead of an error.
- Rebuilt the blocking pipeline around an extension architecture: each block type is a self-contained extension evaluated by a collect-all pipeline.
- The IP whitelist (approved IPs/ranges are never blocked) is now available to everyone.
- Scheduled tasks are reconciled automatically after an in-place update — no need to deactivate/reactivate the plugin to pick up newly added cron jobs.
- Added a link to sentraip.com on the Dashboard and Settings pages so you can discover the optional SentraIP PRO add-on (shown only when PRO is not installed).
- Replaced the bundled Chart.js library with a small self-contained SVG chart renderer, removing a large minified third-party bundle from the plugin.
- Fixed ULTRA plan being treated as a lesser tier for advanced statistics: since ULTRA includes everything in PRO, ULTRA accounts now correctly get the granular (hourly + rate) statistics, the retention settings, the reset action, the full data export and the enhanced continent/region/city country view — previously these were shown only to PRO and ULTRA users were downgraded to the free view. The statistics export now also reports the actual plan name.
- Replaced all direct cURL calls in the plugin's own code with the WordPress HTTP API (wp_remote_get) for dataset downloads, resolve probes and the geolocation database download.
- Moved the remaining inline admin
<script>(Ultra rules data) to wp_add_inline_script(). - Hardened IP whitelist validation: CIDR prefix lengths are now checked against the address family (/32 max for IPv4, /128 max for IPv6), so invalid ranges such as 192.0.2.1/64 are rejected.
- Removed the explicit load_plugin_textdomain() call; WordPress loads plugin translations automatically.
- Translation files (.po/.mo) are no longer bundled — translations are delivered via translate.wordpress.org; only the .pot template ships for translators.
- Updated the bundled Chart.js library to 4.5.1.
- Fixed Datacenter blocking: the whitelist is now honoured. When Datacenter blocking is enabled in Settings, datacenter IPs are blocked unless their provider name is on the Datacenter whitelist (or belongs to the server's own datacenter). The check now reads the "full" datacenter dataset (v4 and v6 when installed) as the single source of truth for both membership and the provider name — so the blocker and the dashboard Blocker Simulator behave identically. Previously the name was read from the flag-only "light" file, so the whitelist never matched and every datacenter IP was blocked.
- Fixed inconsistent Datacenter blocking between IPv4 and IPv6: when a datacenter IP's provider name cannot be resolved (e.g. an IPv6 address with no "full" IPv6 dataset), the whitelist cannot be applied, so the request is now allowed instead of being silently blocked. This makes IPv6 behave like IPv4 for whitelisted providers.
- The downloader now also fetches the "full" IPv6 datasets for VPN and Datacenter when the SentraIP API publishes them, so provider/datacenter names can be resolved for IPv6 clients and the whitelist works fully on IPv6. Previously only the "full" IPv4 file was downloaded.
- Compliance with the WordPress.org Plugin Directory guidelines:
- Renamed the plugin to "SentraIP" (text domain "sentraip") so the name and directory slug no longer begin with the reserved term "wp".
- Documented the freemium model: the plugin is GPL and free; TOR and SPAM datasets are available on the free SentraIP account, other datasets on paid plans. The free account now grants the TOR and SPAM datasets by default.
- Removed the duplicate TOR/SPAM/PROXY/THREAT toggles from the Rules page; these are managed under Settings → Blocking Controls.
- Added leakix, the l9 scanner family and many other scanner/attack tool signatures to the default bot list.
- Chart.js is now bundled with the plugin and served locally instead of being loaded from an external CDN.
- Geolocation is now fully opt-in: no provider is selected by default and no third-party geolocation database is downloaded until you choose a provider on the Geolocation page.
- Expanded the "External services" documentation: geolocation download hosts (DB-IP, MaxMind, IP2Location), when they are contacted, and which credentials are sent; documented the optional spam-IP REST feed.
- Added Apache-2.0 licence notices to the bundled MaxMind DB reader files.
- Trimmed the bundled MaxMind reader to the pure-PHP library actually used at runtime: the build now excludes the native C extension source, its .phpt tests and package metadata (no development tools shipped), while keeping all required LICENSE/NOTICE files.
- Fixed the STARTER plan to grant TOR, SPAM and PROXY, matching the official SentraIP plans.
- Updated "Requires at least" (6.8) and "Tested up to" (7.0).
- Fixed the VPN and Datacenter provider lists, which were empty: provider/datacenter names live only in the
fulldataset (fields vpn_provider / organization), while thelightfile used for blocking carries just a membership flag. The plugin now downloads thefullv4 file for VPN and Datacenter and enumerates names from it (IPv4 only).
- Added the required readme.txt and a full GPLv2 LICENSE file for the WordPress.org Plugin Directory.
- Hardened output escaping across admin pages and switched uninstall queries to prepared statements.
- Namespaced cache keys (transients) and completed cron cleanup on uninstall.
- Removed unused admin pages and their dead handlers/assets.
- Dataset-driven architecture: blocking and configuration pages now follow the datasets your token grants, not the plan name.
- Retention by entitlement: installed database files for granted datasets are never deleted when a listing is empty or partial.
- Downloader reads available IP versions (
ip_versions) and only fetches files that exist. - Configurable retention (7–90 days, default 30) for Blockable Traffic data.
- Settings: removed the "External Services" and "SentraIP API" boxes.
- Recovery:
/wp-admin,/wp-login.phpand/wp-register.phpare never blocked, even when your IP is in a blocklist; the site frontend stays protected. - Updated Italian, Spanish, French and German translations.
- Blockable Traffic (Insights) page, Blocker Simulator, recovery section and translations.
- Spam comment IP collector — blocks IPs from spam comments for 24 hours.
- REST debug endpoint for testing the blocking pipeline.
- Bot check now blocks requests with empty or missing User-Agent.
- Initial release: country and bot blocking, reputation datasets, VPN/Datacenter blocking, composed rules, statistics dashboard and internationalization.