GranTech IP Firewall for AbuseIPDB

GranTech IP Firewall for AbuseIPDB connects your WordPress installation to the community-driven AbuseIPDB database to automatically detect, block, and report abusive IP addresses before they can cause damage — now with a completely redesigned interface and proactive blacklist protection.

Key Features

• Real-time IP checks — Queries the AbuseIPDB API on sensitive endpoints (login, XML-RPC, comments) and blocks IPs exceeding your abuse score threshold.
• Daily blacklist sync — Optionally downloads the 10,000 worst-reputation IPs once a day and blocks them instantly, without spending any check quota. Proactive protection before the first attack.
• Brute-force protection — Detects attacks on wp-login.php and XML-RPC and blocks the offending IP after N failed attempts.
• Automatic reporting — Reports attacking IPs to AbuseIPDB (Brute-Force / Web App Attack categories) with a fully customizable, privacy-safe public comment: your site URL and usernames are never exposed by default.
• False-positive protection — IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked.
• Tor blocking — Optionally block Tor exit nodes on sensitive endpoints regardless of score.
• Email alerts — Get notified when a brute-force attack is blocked (throttled to one email per attacking IP per hour).
• Redesigned admin interface — Modern dashboard with status hero, light & dark themes, API quota indicator, rich IP checker (usage type, distinct reporters, last report), 30-day activity chart and top offenders.
• One-click actions — Block any IP straight from the event log; every IP links to its AbuseIPDB page for instant investigation.
• Dashboard widget — Key security stats at a glance on the main WordPress dashboard.
• Event log — Full filterable history, with configurable retention period.
• Whitelist support — Exempt IPs or CIDR ranges (IPv4 and IPv6) from checks.
• Smart quota management — Response caching, automatic backoff when the daily quota is exhausted, and no API calls for trusted logged-in users.
• Reverse proxy support — Optional trusted-proxy mode for Cloudflare and load balancers (disabled by default to prevent IP spoofing).
• Accessibility — WCAG-conscious interface: AA contrast in both themes, keyboard navigation, screen reader support, reduced-motion and high-contrast modes.

How It Works

1. Once a day (optional), the plugin syncs the AbuseIPDB blacklist locally — the worst 10,000 IPs are blocked instantly with zero API cost.
2. When any other IP accesses a sensitive endpoint (login, XML-RPC, comment submission), the plugin queries the AbuseIPDB API.
3. If the abuse confidence score meets or exceeds your threshold (default 50/100), the IP is blocked automatically. Whitelisted crawlers like Googlebot are always allowed.
4. If multiple failed login attempts are detected from the same IP, it is blocked and reported back to AbuseIPDB, and you can receive an email alert.
5. Everything is recorded in a redesigned dashboard with real-time statistics.

API Requirements

A free account at abuseipdb.com is required. The free plan includes 1,000 checks per day plus daily blacklist downloads — more than enough for most sites when combined with the built-in caching, blacklist sync and smart quota management.

External Services

This plugin connects to the AbuseIPDB API (https://api.abuseipdb.com/api/v2/) to check and report IP addresses.

What is AbuseIPDB? AbuseIPDB is a community-driven project that maintains a database of IP addresses reported for abusive behavior (spam, hacking, brute-force attacks, etc.). This plugin uses their public API to protect your WordPress site.

What data is sent and when?

• IP address check: When a visitor accesses a sensitive endpoint (wp-login.php, xmlrpc.php, comment submission), the visitor’s IP address is sent to AbuseIPDB to retrieve its abuse confidence score. This only happens when the endpoint is accessed — not on regular page visits.
• IP address report: When a brute-force attack is detected (configurable number of failed login attempts), the offending IP address is reported to AbuseIPDB along with a description of the attack and your site’s URL. Reporting can be disabled in the plugin settings.

No personal data other than IP addresses is ever transmitted to AbuseIPDB.

• AbuseIPDB Terms of Service and Privacy Policy: https://www.abuseipdb.com/legal

Privacy Policy

This plugin stores visitor IP addresses in the local WordPress database for the purpose of security logging and blocking. IP addresses are personal data under GDPR.

• What is stored: IP addresses, associated ISP, country, and event type (e.g. blocked, failed login).
• Why: To protect the site from malicious activity and brute-force attacks.
• How long: Log entries are automatically deleted after 90 days. Block entries expire based on the configured duration.
• Third parties: IP addresses may be sent to AbuseIPDB (https://www.abuseipdb.com) for reputation checks and reporting. See the External Services section for details.
• User rights: Site administrators can view and delete all stored data from the plugin’s admin panel or by uninstalling the plugin.