GranTech IP Firewall for AbuseIPDB

GranTech IP Firewall for AbuseIPDB connects your WordPress installation to the community-driven AbuseIPDB database to automatically detect, block, and report abusive IP addresses before they can cause damage — now with a completely redesigned interface and proactive blacklist protection.

Key Features

• Real-time IP checks — Queries the AbuseIPDB API only on sensitive endpoints (wp-login.php, wp-admin, xmlrpc.php, comment submissions, and the JWT/users REST routes) and blocks IPs exceeding your abuse score threshold. Regular page views and front-end traffic never trigger an API call.
• Daily blacklist sync — Optionally downloads the 10,000 worst-reputation IPs once a day and blocks them instantly, without spending any check quota. Proactive protection before the first attack.
• Brute-force protection — Detects attacks on wp-login.php and XML-RPC and blocks the offending IP after N failed attempts.
• Automatic reporting — Reports attacking IPs to AbuseIPDB (Brute-Force + Web App Attack categories) with a fully customizable, privacy-safe public comment: your site URL and usernames are never exposed by default. Optionally reports comment spammers too (Blog Spam category) when a comment is marked as spam.
• False-positive protection — IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked.
• Vulnerability scan detection — Blocks IPs that request many non-existent pages in a short time, as scanners do when probing for files like /.env. No API quota used.
• Bot trap (honeypot) — A hidden link that people never see and robots.txt tells search engines to ignore; bots that follow it anyway are blocked.
• Username enumeration protection — Hides your usernames from anonymous visitors (?author=N, REST API users list, users sitemap, login error messages).
• Monitor mode — Try every protection safely: nothing is blocked or reported, and what would have been blocked is logged.
• Webhooks — Send blocks and attacks to n8n, Make, Zapier, Slack or Microsoft Teams, optionally signed with HMAC-SHA256.
• Tor blocking — Optionally block Tor exit nodes on sensitive endpoints regardless of score.
• Email alerts — Get notified when a brute-force attack is blocked (throttled to one email per attacking IP per hour).
• Redesigned admin interface — Modern dashboard with status hero, light & dark themes, API quota indicator, rich IP checker (usage type, distinct reporters, last report), 30-day activity chart and top offenders.
• Investigation tools — See the community’s own reports behind any score, scan whole CIDR ranges for reported addresses, and withdraw your own reports if an IP was flagged by mistake.
• One-click actions — Block any IP straight from the event log or from a range scan; every IP links to its AbuseIPDB page for instant investigation.
• Dashboard widget — Key security stats at a glance on the main WordPress dashboard.
• Contributor badge — Display your AbuseIPDB contributor badge with the [granipfi_badge] shortcode or a widget; sites that link to AbuseIPDB can request “supporter” status, which comes with higher daily API limits.
• Event log — Full filterable history, with configurable retention period.
• Whitelist support — Exempt IPs or CIDR ranges (IPv4 and IPv6) from checks.
• Smart quota management — Response caching, automatic backoff when the daily quota is exhausted, and no API calls for trusted logged-in users.
• Reverse proxy support — Optional trusted-proxy mode for Cloudflare and load balancers (disabled by default to prevent IP spoofing).
• Accessibility — WCAG-conscious interface: AA contrast in both themes, keyboard navigation, screen reader support, reduced-motion and high-contrast modes.

How It Works

1. Once a day (optional), the plugin syncs the AbuseIPDB blacklist locally — the worst 10,000 IPs are blocked instantly with zero API cost.
2. When any other IP accesses a sensitive endpoint (login, XML-RPC, comment submission), the plugin queries the AbuseIPDB API.
3. If the abuse confidence score meets or exceeds your threshold (default 50/100), the IP is blocked automatically. Whitelisted crawlers like Googlebot are always allowed.
4. If multiple failed login attempts are detected from the same IP, it is blocked and reported back to AbuseIPDB, and you can receive an email alert.
5. Everything is recorded in a redesigned dashboard with real-time statistics.

API Requirements

A free account at abuseipdb.com is required.
The free plan includes 1,000 checks per day plus daily blacklist downloads — more than enough for most sites when combined with the built-in caching, blacklist sync and smart quota management.

External Services

This plugin connects to the AbuseIPDB API (https://api.abuseipdb.com/api/v2/) to check and report IP addresses.

What is AbuseIPDB?
AbuseIPDB is a community-driven project that maintains a database of IP addresses reported for abusive behavior (spam, hacking, brute-force attacks, etc.). This plugin uses their public API to protect your WordPress site.

What data is sent and when?

• IP address check: When a visitor accesses a sensitive endpoint (wp-login.php, xmlrpc.php, comment submission), the visitor’s IP address is sent to AbuseIPDB to retrieve its abuse confidence score. This only happens when the endpoint is accessed — not on regular page visits.
• IP address report: When a brute-force attack is detected (configurable number of failed login attempts), the offending IP address is reported to AbuseIPDB along with a generic description of the attack. For privacy, your site URL and usernames are NOT included by default (the comment template is customizable). Reporting can be disabled in the plugin settings.
• Blacklist download: If the daily blacklist sync option is enabled, the plugin downloads the AbuseIPDB blacklist once a day. No visitor data is sent in this request.
• Comment spam report (optional, off by default): When enabled, the IP address of a comment classified as spam (by an anti-spam filter or by a moderator) is reported to AbuseIPDB with a generic description. The comment text and author details are never sent, and comments from registered users are never reported.
• Scan and bot reports (optional, off by default): When enabled, IPs blocked by the 404 scan detection or the bot trap are reported to AbuseIPDB (categories Web App Attack and Bad Web Bot) with a generic, privacy-safe description.
• Contributor badge (optional): If you enter your AbuseIPDB user ID and place the [granipfi_badge] shortcode or widget, your visitors’ browsers load the badge image from abuseipdb.com (https://www.abuseipdb.com/contributor/). Nothing is loaded unless you place the shortcode or widget yourself.

No personal data other than IP addresses is ever transmitted to AbuseIPDB.

Webhooks (optional, off by default): If you enter a webhook URL, security events (event type, IP address, score, country, ISP, site URL and time) are sent to that URL — and only to that URL, which you choose. Nothing is sent while the webhook URL is empty.

• AbuseIPDB Terms of Service and Privacy Policy: https://www.abuseipdb.com/legal

Privacy Policy

This plugin stores visitor IP addresses in the local WordPress database for the purpose of security logging and blocking. IP addresses are personal data under GDPR.

• What is stored: IP addresses, associated ISP, country, and event type (e.g. blocked, failed login).
• Why: To protect the site from malicious activity and brute-force attacks.
• How long: Log entries are automatically deleted after a configurable retention period (90 days by default, minimum 7). Block entries expire based on the configured duration.
• Third parties: IP addresses may be sent to AbuseIPDB (https://www.abuseipdb.com) for reputation checks and reporting. See the External Services section for details.
• User rights: Site administrators can view and delete all stored data from the plugin’s admin panel or by uninstalling the plugin.

1. Upload the grantech-ip-firewall-for-abuseipdb folder to the /wp-content/plugins/ directory.
2. Activate the plugin through the Plugins menu in WordPress.
3. Go to IP Shield → Settings in the WordPress admin menu and paste your AbuseIPDB API key.
4. Adjust the score threshold and brute-force parameters to suit your needs.
5. Done — your site is now protected.

Recommended Settings

• Block threshold: 50 (blocks IPs with >50% abuse probability)
• Block duration: 24 hours
• Attempts before block: 5
• Time window: 10 minutes
• API cache: 60 minutes
• Report brute-force: Enabled

1. 

   Dashboard: protection status, remaining AbuseIPDB API quota and 30-day security statistics.

2. 

   Live IP checker: abuse score, usage type, hostnames and the community's own recent reports as evidence.

3. 

   Blocklist: blocked IPs with score, source and expiry, plus one-click removal.

4. 

   Event log: full filterable history by IP and event type.

5. 

   Settings: sectioned options with toggle switches, plus the IP range scanner and report tools.

1.4.1

• Fix: The 1.4.0 package published on WordPress.org was missing five new files, which caused a fatal error (“Class GranIPFI\Scan_Detector not found”) after updating. This release contains every file.
• Safety: The plugin now checks that all its files are present before starting. If an installation is ever incomplete, the plugin stays inactive and shows an admin notice instead of breaking the site.

1.4.0

• New: Vulnerability scan detection — blocks IPs that trigger many 404 errors in a short time (configurable), ignoring missing images, styles and scripts. Uses no API quota.
• New: Bot trap (honeypot) — a hidden link, disallowed in robots.txt, that only bad bots follow.
• New: Username enumeration protection — blocks ?author=N, the REST API users list and the users sitemap for anonymous visitors, and makes login errors generic.
• New: Monitor mode — nothing is blocked or reported; every block that would have happened is logged as monitor_would_block. Clearly shown on the Dashboard.
• New: Webhooks in generic JSON, Slack or Microsoft Teams format, throttled and optionally signed (X-GranIPFI-Signature), with a “Send test message” button.
• New: Optional reporting of detected scanners (Web App Attack) and trapped bots (Bad Web Bot) to AbuseIPDB.
• New: granipfi_event_logged action for developers.
• New: Each bar of the activity chart now links to the event log filtered by that day, and the chart always shows the full 30 days (days without events included). The bars are keyboard and screen reader accessible.
• New: Date filter in the event log.
• Fix: Pagination in the event log no longer drops the active IP and event filters.
• Fix: The admin styles and scripts are now always refreshed after an update, instead of browsers or page caches serving an outdated copy.
• Safety: the new detections never block whitelisted IPs, logged-in editors, search engine crawlers or IPs on the official AbuseIPDB whitelist. All of them are off by default.

1.3.1

• Fix: The translations bundled with the plugin are now loaded as a fallback, so new strings appear translated immediately instead of in English until they are approved on translate.wordpress.org. Approved language packs from WordPress.org still take priority.
• Improvement: The “What’s new” notice is shown only for new feature releases, not again after small maintenance updates.
• Accessibility: Light-theme text colours now meet WCAG AA contrast (links, IP addresses and status chips were below 4.5:1).
• Accessibility: Correct heading hierarchy on every admin page (h1 → h2 → h3, no skipped levels).
• Accessibility: The activity chart now has a text alternative for screen readers, and links that open a new tab announce it.
• Fix: The IP checker verdicts (High risk, Suspicious, Clean, Tor exit node) were hardcoded in English; they are now translatable, and their decorative icons are hidden from screen readers.
• Security hardening: Translated strings are now escaped before being inserted into the page by JavaScript.

1.3.0

• New: AbuseIPDB contributor badge — show it with the [granipfi_badge] shortcode or the “AbuseIPDB Contributor Badge” widget. Sites that link to AbuseIPDB can request “supporter” status (with higher daily API limits) by contacting AbuseIPDB; it is not granted automatically. Fully opt-in: nothing is shown until you enter your user ID and place the shortcode or widget.
• New: Opt-in reporting of comment spammers to AbuseIPDB (Blog Spam category). Only comments actually classified as spam are reported — on submission by an anti-spam filter such as Akismet, or when a moderator marks them as spam. Registered users and private IP ranges are never reported, and the comment text is never sent.
• Improvement: Login brute-force reports now use categories 18 + 21 (Brute-Force + Web App Attack), as AbuseIPDB recommends for attacks on WordPress.
• Improvement: Destructive actions (remove from blocklist, block a whole range, withdraw reports) now use accessible inline confirmations instead of native browser dialogs. This also removes the remaining inline JavaScript handlers and translates a confirmation message that was hardcoded in English.
• New: Catalan (ca) translation.

1.2.0

• New: The live IP checker now shows the evidence behind a score — the community’s own recent reports (date, reporter country and comment) in a collapsible panel, plus the resolved hostnames.
• New: IP range scanner (Tools) — check a whole subnet against AbuseIPDB (up to /24 on the free plan), see every reported address sorted by score, and block them individually or all at once with a single button. Blocks respect your configured block duration, skip whitelisted IPs, and you stay on the scan results after blocking.
• New: “Withdraw my reports” tool — deletes the reports your own account submitted for an IP, useful when an address was reported by mistake (e.g. after a proxy misconfiguration).
• New: Configurable report history window (1-365 days, default 90) — lower values focus on currently active threats and reduce false positives.
• New: Configurable blacklist size (100-10,000 IPs) for the daily sync, so small hosting plans can keep the local table light.
• Fix: Removed the WooCommerce wc-ajax endpoint from firewall checks — store traffic no longer consumes API quota.
• Fix: Readme accuracy — corrected the admin menu name (IP Shield), the full list of protected endpoints, and documented all four public hooks for developers.

1.1.0

• New: One-time dismissible “What’s new” banner on the plugin Dashboard after each update, summarizing the highlights.
• New: Daily AbuseIPDB blacklist sync (opt-in) — downloads the worst-reputation IPs (up to 10,000) once a day into a local table and blocks them instantly on sensitive endpoints, without spending check quota.
• New: The official AbuseIPDB whitelist is now respected — whitelisted IPs (search engine crawlers, major CDNs) are never blocked, preventing false positives like blocking Googlebot.
• New: Richer live IP check — now shows usage type, domain, distinct reporters, last-reported date and whitelist/Tor badges.
• New: Completely redesigned admin interface — modern dual theme (light by default, dark via system preference), GranTech brand identity (teal + navy), status hero on the Dashboard, toggle switches, Dashicons instead of emojis, section navigation in Settings, and refined tables, cards and charts.
• Accessibility: All WCAG improvements preserved and extended — AA contrast verified in both themes, teal focus rings, forced-colors and reduced-motion support, 40px+ touch targets.
• Fix: Live IP check was broken by a JavaScript syntax error — now working again.
• Security: The AbuseIPDB API key is no longer printed in the Settings page HTML source; leave the field empty to keep the saved key.
• Security: Numeric settings are now clamped server-side (e.g. a score threshold of 0 — which would block every visitor — can no longer be saved).
• Fix: Multi-line report comment templates no longer lose their line breaks when saved.
• New: Option to block Tor exit nodes on sensitive endpoints (opt-in), using the isTor flag already returned by the AbuseIPDB API.
• New: AbuseIPDB daily API quota indicator on the Dashboard (remaining/limit with color coding), captured from the API response headers.
• New: Block button directly in the Event Log rows for one-click blocking of suspicious IPs.
• New: Configurable log retention period in Settings (default 90 days, minimum 7).
• Improvement: Automatic backoff when the daily API quota is exhausted (HTTP 429) — API checks pause until the quota resets at midnight UTC, keeping your site fast.
• Improvement: API check timeout reduced from 10s to 5s so visitors never wait long if AbuseIPDB is slow; reports keep the 10s timeout.
• Improvement: Authenticated users with editing capabilities are no longer checked against the API — saves quota and prevents locking yourself out of wp-admin.
• Improvement: Comment IP checks now require the real wp-comments-post.php endpoint, so unrelated forms with a “comment” field no longer trigger API calls.

1.0.5

• New: IP addresses in the Blocklist, Event Log and Dashboard are now clickable — they open the corresponding AbuseIPDB check page (abuseipdb.com/check/{IP}) in a new tab for quick investigation. (Thanks for the suggestion!)
• New: Option to report XML-RPC attacks to AbuseIPDB (opt-in) — IPs exceeding the failed-attempts limit via XML-RPC are reported with categories Brute-Force + Web App Attack, using a vector-specific privacy-safe comment.
• Fix: Added missing translators comments to email notification strings (plugin checker warnings).

1.0.4

• Security: IP detection no longer trusts proxy headers (X-Forwarded-For, CF-Connecting-IP) by default — prevents IP spoofing. New “Trust proxy headers” option for sites behind Cloudflare or a load balancer.
• Privacy: AbuseIPDB report comments no longer include the site URL or targeted username by default — reports are publicly visible on abuseipdb.com.
• New: Customizable report comment template in Settings with placeholders: {attempts}, {window}, {username}, {site}.
• New: granipfi_report_comment filter for developers to programmatically modify report comments.
• New: Email alerts — get notified when a brute-force attack is blocked (throttled to one per attacking IP per hour, configurable recipient).
• New: Dashboard widget — at-a-glance security stats on the main WordPress admin dashboard.
• Fix: “Repair database tables” button now works — the handler was never registered.
• Fix: CIDR whitelist now supports IPv6 ranges (previously IPv4-only).
• Fix: Cron cleanup is rescheduled automatically if it goes missing after a migration.
• Fix: Activation now records DB version to prevent unnecessary table recreation.
• Fix: Added missing event types (xmlrpc_blocked, xmlrpc_probe, report_failed) to the event log filter and styles.
• Fix: Spanish (es_ES) translation completed and aligned with the official WordPress.org es_ES glossary (informar, malintencionado, avisos, Escritorio, ajustes, caduca…).
• Performance: is_blocked() result cached per-IP for 60 seconds — avoids a DB query on every request.
• Performance: Dashboard statistics cached for 5 minutes — avoids 3 heavy GROUP BY queries on every page load.

1.0.3

• Fix: Removed .gitignore file not permitted in WordPress.org plugin repository.

1.0.2

• i18n: Full internationalization — all admin view strings wrapped in __() translation functions.
• i18n: Plugin now displays correctly in any WordPress language based on site settings.
• i18n: English as source language; Spanish (es_ES) loaded automatically via .mo file.
• Fix: Removed remaining hardcoded Spanish strings from all admin views.
• Fix: CSS prefix updated — all classes renamed from shield- to granipfi-.
• Fix: JS global object renamed from AbuseIPDBShield to GranIPFI.

1.0.1

• Fix: Blocklist page showing empty despite IPs being blocked — fixed by adding automatic DB table creation/repair on every plugin load.
• Fix: Added DB version check (granipfi_db_version) to ensure tables are always present and up to date after updates or migrations.
• Improvement: Added database repair tool in Settings page for manual recovery.
• Fix: Admin panel title text color now correctly displays white on dark background.
• Accessibility: Added aria-hidden=”true” to all decorative dashicons.
• Accessibility: Added scope=”col” to all table header cells (17 instances).
• Accessibility: Added aria-label to all data tables.
• Accessibility: Added aria-live=”polite” and aria-atomic to AJAX result region.
• Accessibility: Added role=”status” to success notices and role=”alert” to error notices.
• Accessibility: Added aria-busy state to Verify IP button during async requests.
• Accessibility: Replaced with on IP check input field.
• Accessibility: Added for= attribute to filter labels in event log.
• Accessibility: Added aria-describedby to all settings form fields.
• Accessibility: All font sizes increased to minimum 12px (previously 10-11px).
• Accessibility: Removed outline:none from focus states — now shows visible 2px blue outline.
• Accessibility: Fixed focus-visible selector pointing to non-existent .shield-field class.
• Accessibility: Added focus and focus-visible styles for all interactive elements.
• Accessibility: Added border to score badges and event chips (non-color visual cue, WCAG 1.4.1).
• Accessibility: Added text-decoration:underline to pagination links (WCAG 1.4.1).
• Accessibility: Improved color contrast ratio of muted text: #8b949e → #a0aab8 (~5.2:1).
• Accessibility: Added prefers-reduced-motion support — disables transitions/animations.
• Accessibility: Added forced-colors (Windows High Contrast) support with borders and forced-color-adjust.
• Accessibility: Added minimum touch target size 44x44px to buttons and pagination links (WCAG 2.5.8).
• Accessibility: Added screen-reader-text utility class (WordPress standard).

1.0.0

• Initial release.
• Real-time IP checks against the AbuseIPDB v2 API.
• Automatic blocking based on configurable score threshold.
• Brute-force protection for wp-login.php and XML-RPC.
• Automatic reporting of aggressive IPs to AbuseIPDB.
• Admin dashboard with statistics and activity chart.
• Event log with filters.
• Manual blocklist with configurable expiry.
• Whitelist with CIDR range support.
• API response caching via WordPress transients.
• Cloudflare and reverse proxy support.
• Spanish (es_ES) translation included.