[WordPress] 外掛分享： GranTech IP Firewall for AbuseIPDB

內容簡介

GranTech IP Firewall for AbuseIPDB 將您的 WordPress 安裝與社群驅動的 AbuseIPDB 數據庫連接，能自動檢測、封鎖及報告惡意 IP 地址，防止其造成損害，並提供全新設計的介面及主動黑名單保護。

【主要功能】
• 實時 IP 檢查
• 每日黑名單同步
• 暴力破解保護
• 自動報告攻擊 IP
• 假陽性保護
• Tor 封鎖選項

外掛標籤

開發者團隊

原文外掛簡介

GranTech IP Firewall for AbuseIPDB connects your WordPress installation to the community-driven AbuseIPDB database to automatically detect, block, and report abusive IP addresses before they can cause damage — now with a completely redesigned interface and proactive blacklist protection.
Key Features

Real-time IP checks — Queries the AbuseIPDB API only on sensitive endpoints (wp-login.php, wp-admin, xmlrpc.php, comment submissions, and the JWT/users REST routes) and blocks IPs exceeding your abuse score threshold. Regular page views and front-end traffic never trigger an API call.
Daily blacklist sync — Optionally downloads the 10,000 worst-reputation IPs once a day and blocks them instantly, without spending any check quota. Proactive protection before the first attack.
Brute-force protection — Detects attacks on wp-login.php and XML-RPC and blocks the offending IP after N failed attempts.
Automatic reporting — Reports attacking IPs to AbuseIPDB (Brute-Force / Web App Attack categories) with a fully customizable, privacy-safe public comment: your site URL and usernames are never exposed by default.
False-positive protection — IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked.
Tor blocking — Optionally block Tor exit nodes on sensitive endpoints regardless of score.
Email alerts — Get notified when a brute-force attack is blocked (throttled to one email per attacking IP per hour).
Redesigned admin interface — Modern dashboard with status hero, light & dark themes, API quota indicator, rich IP checker (usage type, distinct reporters, last report), 30-day activity chart and top offenders.
Investigation tools — See the community’s own reports behind any score, scan whole CIDR ranges for reported addresses, and withdraw your own reports if an IP was flagged by mistake.
One-click actions — Block any IP straight from the event log or from a range scan; every IP links to its AbuseIPDB page for instant investigation.
Dashboard widget — Key security stats at a glance on the main WordPress dashboard.
Event log — Full filterable history, with configurable retention period.
Whitelist support — Exempt IPs or CIDR ranges (IPv4 and IPv6) from checks.
Smart quota management — Response caching, automatic backoff when the daily quota is exhausted, and no API calls for trusted logged-in users.
Reverse proxy support — Optional trusted-proxy mode for Cloudflare and load balancers (disabled by default to prevent IP spoofing).
Accessibility — WCAG-conscious interface: AA contrast in both themes, keyboard navigation, screen reader support, reduced-motion and high-contrast modes.

How It Works

Once a day (optional), the plugin syncs the AbuseIPDB blacklist locally — the worst 10,000 IPs are blocked instantly with zero API cost.
When any other IP accesses a sensitive endpoint (login, XML-RPC, comment submission), the plugin queries the AbuseIPDB API.
If the abuse confidence score meets or exceeds your threshold (default 50/100), the IP is blocked automatically. Whitelisted crawlers like Googlebot are always allowed.
If multiple failed login attempts are detected from the same IP, it is blocked and reported back to AbuseIPDB, and you can receive an email alert.
Everything is recorded in a redesigned dashboard with real-time statistics.

API Requirements
A free account at abuseipdb.com is required.
The free plan includes 1,000 checks per day plus daily blacklist downloads — more than enough for most sites when combined with the built-in caching, blacklist sync and smart quota management.
External Services
This plugin connects to the AbuseIPDB API (https://api.abuseipdb.com/api/v2/) to check and report IP addresses.
What is AbuseIPDB?
AbuseIPDB is a community-driven project that maintains a database of IP addresses reported for abusive behavior (spam, hacking, brute-force attacks, etc.). This plugin uses their public API to protect your WordPress site.
What data is sent and when?

IP address check: When a visitor accesses a sensitive endpoint (wp-login.php, xmlrpc.php, comment submission), the visitor’s IP address is sent to AbuseIPDB to retrieve its abuse confidence score. This only happens when the endpoint is accessed — not on regular page visits.
IP address report: When a brute-force attack is detected (configurable number of failed login attempts), the offending IP address is reported to AbuseIPDB along with a generic description of the attack. For privacy, your site URL and usernames are NOT included by default (the comment template is customizable). Reporting can be disabled in the plugin settings.
Blacklist download: If the daily blacklist sync option is enabled, the plugin downloads the AbuseIPDB blacklist once a day. No visitor data is sent in this request.

No personal data other than IP addresses is ever transmitted to AbuseIPDB.

AbuseIPDB Terms of Service and Privacy Policy: https://www.abuseipdb.com/legal

Privacy Policy
This plugin stores visitor IP addresses in the local WordPress database for the purpose of security logging and blocking. IP addresses are personal data under GDPR.

What is stored: IP addresses, associated ISP, country, and event type (e.g. blocked, failed login).
Why: To protect the site from malicious activity and brute-force attacks.
How long: Log entries are automatically deleted after a configurable retention period (90 days by default, minimum 7). Block entries expire based on the configured duration.
Third parties: IP addresses may be sent to AbuseIPDB (https://www.abuseipdb.com) for reputation checks and reporting. See the External Services section for details.
User rights: Site administrators can view and delete all stored data from the plugin’s admin panel or by uninstalling the plugin.