Thessley Security Hardening

Every blocking module exempts your LAN, reserved/private IP space, and anything in the trusted-networks list, before it ever looks at the rest of its rules. Geo Blocker and Geo Login specifically cannot lock out your own network regardless of which countries you select.

The early-request checks (IP Blocklist, Geo Blocker, Geo Login, Rate Limiter, Query Guard's query-string scan) run as a must-use plugin before WordPress finishes bootstrapping, using compiled binary-search lookups rather than database queries — no per-request network calls, no per-request external API hits.

Two places by default, both created by the plugin itself and both removed when it is deleted (the loader file also when you deactivate it), plus one optional block you can switch on in Hardening:

1. wp-content/mu-plugins/wp-thessley-early.php — a single small must-use plugin. This is what lets the blocking modules run before WordPress and other plugins load, the same reason caching plugins install a drop-in. It contains no site-specific data and is a copy of mu-loader/wp-thessley-early.php inside this plugin. It loads each enabled module's check.php directly from this plugin's folder, so nothing else is copied into wp-content. If mu-plugins isn't writable, the plugin still works, but early blocking is off and an admin notice says so.
2. wp-content/uploads/thessley-security-hardening/ — compiled datasets (the merged IP-blocklist ranges, the geo-country index, the trusted-networks list), located with wp_upload_dir() and protected from direct web access with .htaccess and an index.php. They are plain data files (binary, JSON and text), never PHP, and nothing in this folder is executed.
3. Optional, off by default: the "Web-root protection" setting in Hardening adds one marked block to the site's .htaccess (using WordPress' own insert_with_markers()) that makes Apache refuse files such as wp-config.php.bak, database dumps, error_log, readme.html and stray archives, which the web server would otherwise hand out without PHP ever running. Unchecking the setting, or deactivating the plugin, removes exactly that block.

DB-IP's free Country Lite database (CC BY 4.0), refreshed automatically on a schedule.