內容簡介
SentraIP 是一款能在 WordPress 應用層之前過濾不必要訪客的外掛，透過本地資料庫檔案進行 IP 阻擋，無需外部請求，確保網站安全且高效。
【主要功能】
• 國家地理位置阻擋
• 機器人阻擋
• 垃圾評論 IP 阻擋
• 自訂回應代碼
• IP 白名單管理
• 阻擋模擬器
外掛標籤
開發者團隊
原文外掛簡介
SentraIP filters unwanted visitors before they reach your WordPress application layer. Blocking runs on the WordPress init hook, before your theme and most plugins load, and every lookup is performed locally against offline MMDB database files in your uploads directory — so no external request is made on normal page loads.
The plugin is free and open source (GPLv2 or later), maintained by Move Forward Limited. It works out of the box and no account and no paid plan is ever required to use it.
What it blocks
Country (geolocation) blocking — block visitors by country. You download a free IP-to-country database from a provider of your choice (DB-IP, MaxMind GeoLite2 or IP2Location LITE); your own admin country and your server’s country are excluded automatically so you never lock yourself out.
Bot blocking — block well-known crawlers, scanners and attack tools (Googlebot, GPTBot, SemrushBot, AhrefsBot, ClaudeBot and many more) by User-Agent. Requests with an empty or missing User-Agent can also be blocked.
Spam-comment IP blocking — IPs from comments marked as spam (manually, by bulk action, or by Akismet) are blocked automatically for 24 hours. This needs no external data at all.
Free SPAM reputation dataset (opt-in) — optionally download a free SPAM IP reputation database to block known spam sources. Entirely opt-in, no account required.
IP whitelist — approved IPs and CIDR ranges are never blocked, so you can always guarantee your own access.
Statistics & Blockable Traffic insights — see what was blocked over time, and see allowed traffic that matched a dataset so you can decide what to start filtering.
Blocker Simulator — test what the blocker would do for any IP / User-Agent, without blocking anything.
Configurable response — return 403, 404, 410, 444 or 503 for blocked requests.
Proxy-aware — behind Cloudflare or a reverse proxy, enable “Trust Proxy Headers” so the real visitor IP is used for every check.
Lockout-safe by design — the WordPress admin (/wp-admin), /wp-login.php and /wp-register.php are never blocked, logged-in users are never blocked, and an emergency kill switch (WP_SENTRAIP_DISABLE_BLOCKING) can disable all blocking from wp-config.php.
Secure storage — database files live in a protected uploads subdirectory guarded by .htaccess and index.php.
Advanced datasets (optional add-on)
Additional IP-reputation datasets — VPN, TOR, PROXY, THREAT and Datacenter blocking, per-provider VPN blocklists, and composed AND/OR rules — are available through a separate companion plugin, SentraIP PRO, which connects to a SentraIP account. This free plugin is fully functional on its own and never requires the add-on. See https://sentraip.com for details.
How it works
Choose a geolocation provider on the Geolocation page and download the country database (a monthly WordPress cron keeps it fresh). Configure your rules under Countries, Bots and Settings → Blocking Controls. Every request is then checked locally against the offline database files — there is no per-request external call.
External services
To keep visitor lookups fast and offline, this plugin downloads database files from a few third-party services. Understanding which services are contacted, and what data is sent, is important for your privacy and legal compliance. No external request is made on normal visitor page loads — only when a database is downloaded or refreshed, and only for the features you opt into.
Free SPAM dataset (opt-in, no account required)
The free version can download a SentraIP SPAM reputation database to block known spam sources. This is entirely opt-in and needs no API token or account.
What it is used for: downloading and monthly refreshing the free SPAM MMDB database used for blocking.
When data is sent: only after you enable the free SPAM dataset on the SentraIP → Settings page. Nothing is downloaded on activation or without your consent, and no request is made on normal visitor page loads.
What data is sent: your site host name and a public key generated for your installation (used to authorise the download). The plugin generates a key pair locally, registers only the public key with SentraIP (app.sentraip.com), and signs each download request; the private key never leaves your server. No visitor IP address or personal data is sent.
If you do not enable it: SPAM blocking still works — IP addresses from comments you mark as spam are blocked automatically, with no external request. The dataset is an optional enhancement, not a requirement.
Service site / terms: https://sentraip.com
Privacy policy: https://www.mforward.eu/privacy-policy/ (Terms: https://sentraip.com/plugin-terms-of-service/)
Sharing spam-comment IPs with SentraIP (opt-in, off by default)
You can optionally let SentraIP collect the IP addresses of comments you mark as spam, to help improve protection for every site using SentraIP.
What it is used for: contributing your spam-comment IPs to SentraIP’s shared reputation data.
When data is sent: only after you tick Share spam IPs with SentraIP on the SentraIP → Settings page. It is off by default; with the box unticked nothing is ever shared and the feed endpoint refuses all requests.
What data is sent: only the IP addresses recorded from comments you marked as spam (a ~15-day window). No comment content, author names, e-mails or other personal data are sent. SentraIP reads the list over an authenticated request signed with its own key; your site verifies that signature before responding.
If you do not enable it: spam-comment IP blocking still works locally on your site exactly as before — this option only governs sharing.
Service site / terms: https://sentraip.com
Privacy policy: https://www.mforward.eu/privacy-policy/ (Terms: https://sentraip.com/plugin-terms-of-service/)
Geolocation database providers (opt-in)
Country blocking needs an IP geolocation database, which you download from one free third-party provider that you choose on the SentraIP → Geolocation page. No provider is selected by default and no geolocation download happens until you explicitly opt in by choosing one. Once a provider is configured, its database is also refreshed automatically once a month by a WordPress cron job. The database is queried locally on your server; no visitor data is sent to these providers at request time.
DB-IP (https://db-ip.com) — recommended, no registration. Downloads from download.db-ip.com. No credential is sent. Terms: https://db-ip.com/tos.php
MaxMind GeoLite2 (https://www.maxmind.com) — requires a free account. Downloads from download.maxmind.com; your MaxMind license key is sent to authenticate the download. Privacy: https://www.maxmind.com/en/privacy-policy
IP2Location LITE (https://lite.ip2location.com) — requires a free account. Downloads from www.ip2location.com; your IP2Location download token is sent to authenticate the download. Terms: https://www.ip2location.com/terms
See the attribution notes below for the data licences of each provider.
Attributions
Depending on the geolocation provider you choose, this product includes data that requires attribution:
DB-IP: IP Geolocation by DB-IP (https://db-ip.com), licensed under CC-BY 4.0.
MaxMind: This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
IP2Location: This product uses IP2Location LITE data available from https://lite.ip2location.com.
The bundled MaxMind DB reader library is distributed under the Apache License 2.0.
The admin charts are drawn by a small self-contained SVG renderer bundled with the plugin (admin/js/wp-sentraip-charts.js) — no third-party JavaScript charting library is used.
