IP Geo Block

Screenshots

A considerable number of WordPress vulnerabilities in plugins and themes have been disclosed every month on a site like WPScan Vulnerability Database and Exploits Database. It means that we’re always exposed to the threats of being exploited caused by them. This plugin guards your site against threats of attack to back-end of your site such as login form, XML-RPC (login attempt) and admin area. It also blocks undesired comment spam, trackback and pingback spam and any requests to public facing pages aka front-end from undesired countries. After several days of installation, you’ll be supprised to find many malicious or undesirable accesses are blocked especially if you enable Zero-day Expoit Prevention. Features Immigration control: Access to the basic and important entrances into back-end such as wp-comments-post.php, xmlrpc.php, wp-login.php, wp-signup.php, wp-admin/admin.php, wp-admin/admin-ajax.php, wp-admin/admin-post.php will be validated by means of a country code based on IP address. It allows you to configure either whitelist or blacklist to specify the countires, CIDR notation for a range of IP addresses and AS number for a group of IP networks. Zero-day Exploit Prevention: Unlike other security firewalls based on attack patterns (vectors), the original feature “WordPress Zero-day Exploit Prevention” (WP-ZEP) is focused on patterns of vulnerability. It is simple but still smart and strong enough to block any malicious accesses to wp-admin/*.php, plugins/*.php and themes/*.php even from the permitted countries. It will protect your site against certain types of attack such as CSRF, LFI, SQLi, XSS and so on, even if you have some vulnerable plugins and themes in your site. Guard against login attempts: In order to prevent hacking through the login form and XML-RPC by brute-force and the reverse-brute-force attacks, the number of login attempts will be limited per IP address even from the permitted countries. Minimize server load against brute-force attacks: You can configure this plugin as a Must Use Plugins so that this plugin can be loaded prior to regular plugins. It can massively reduce the load on server. Prevent malicious down/uploading: A malicious request such as exposing wp-config.php or uploading malwares via vulnerable plugins/themes can be blocked. Support of BuddyPress and bbPress: You can configure this plugin so that a registered user can login as a membership from anywhere, while a request such as a new user registration, lost password, creating a new topic and subscribing comment can be blocked by country. It is suitable for BuddyPress and bbPress to help reducing spams. Referrer suppressor for external links: When you click an external hyperlink on admin screens, http referrer will be eliminated to hide a footprint of your site. Multiple source of IP Geolocation databases: MaxMind GeoLite free databases and IP2Location LITE databases can be installed in this plugin. Also free Geolocation REST APIs and whois information can be available for audit purposes. Father more, if you use CloudFlare or CloudFront as a reverse proxy service, you can install the dedicated API class libraries for these services. Customizing response: HTTP response code can be selectable as 403 Forbidden to deny access pages, 404 Not Found to hide pages or even 200 OK to redirect to the top page. You can also have a human friendly page (like 404.php) in your theme template directory or child theme directory to fit your theme. Validation logs: Validation logs can be recorded with useful information to audit attack patterns. Cooperation with full spec security plugin: This plugin is simple and lite enough to be able to cooperate with other full spec security plugin such as Wordfence Security. See this report about page speed performance. Extendability: You can customize the behavior of this plugin via add_filter() with pre-defined filter hook. See various use cases in samples.php bundled within this package. You can also get the extension IP Geo Allow by Dragan. It makes admin screens strictly private with more flexible way than specifying IP addresses. Self blocking prevention and easy rescue: Website owners do not prefer themselves to be blocked. This plugin prevents such a sad thing unless you force it. And futhermore, if such a situation occurs, you can rescue yourself easily. Clean uninstallation: Nothing is left in your precious mySQL database after uninstallation. So you can feel free to install and activate to make a trial of this plugin’s functionality. Attribution This package includes GeoLite library distributed by MaxMind, available from MaxMind, and also includes IP2Location open source libraries available from IP2Location. Also thanks for providing the following great services and REST APIs for free. http://freegeoip.net/ (IPv4 / free) http://ipinfo.io/ (IPv4, IPv6 / free) http://geoip.nekudo.com/ (IPv4, IPv6 / free) http://xhanch.com/ (IPv4 / free) http://geoiplookup.net/ (IPv4, IPv6 / free) http://ip-api.com/ (IPv4, IPv6 / free for non-commercial use) http://ipinfodb.com/ (IPv4, IPv6 / free for registered user, need API key) Development Development of this plugin is promoted at WordPress-IP-Geo-Block and class libraries to handle geo-location database are developed separately as “add-in”s at WordPress-IP-Geo-API. All contributions will always be welcome. Or visit my development blog. Known issues No image is shown after drag & drop a image in grid view at “Media Library”. For more details, please refer to this ticket at Github. From WordPress 4.5, rel=nofollow had no longer be attached to the links in comment_content. This change prevents to block “Server Side Request Forgeries” (not Cross Site but a malicious internal link in the comment field).