Description
GranTech IP Firewall for AbuseIPDB connects your WordPress installation to the community-driven AbuseIPDB database to automatically detect, block, and report abusive IP addresses before they can cause damage — now with a completely redesigned interface and proactive blacklist protection.
Key Features
- Real-time IP checks — Queries the AbuseIPDB API only on sensitive endpoints (wp-login.php, wp-admin, xmlrpc.php, comment submissions, and the JWT/users REST routes) and blocks IPs exceeding your abuse score threshold. Regular page views and front-end traffic never trigger an API call.
- Daily blacklist sync — Optionally downloads the 10,000 worst-reputation IPs once a day and blocks them instantly, without spending any check quota. Proactive protection before the first attack.
- Brute-force protection — Detects attacks on wp-login.php and XML-RPC and blocks the offending IP after N failed attempts.
- Automatic reporting — Reports attacking IPs to AbuseIPDB (Brute-Force / Web App Attack categories) with a fully customizable, privacy-safe public comment: your site URL and usernames are never exposed by default.
- False-positive protection — IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked.
- Tor blocking — Optionally block Tor exit nodes on sensitive endpoints regardless of score.
- Email alerts — Get notified when a brute-force attack is blocked (throttled to one email per attacking IP per hour).
- Redesigned admin interface — Modern dashboard with status hero, light & dark themes, API quota indicator, rich IP checker (usage type, distinct reporters, last report), 30-day activity chart and top offenders.
- Investigation tools — See the community’s own reports behind any score, scan whole CIDR ranges for reported addresses, and withdraw your own reports if an IP was flagged by mistake.
- One-click actions — Block any IP straight from the event log or from a range scan; every IP links to its AbuseIPDB page for instant investigation.
- Dashboard widget — Key security stats at a glance on the main WordPress dashboard.
- Event log — Full filterable history, with configurable retention period.
- Whitelist support — Exempt IPs or CIDR ranges (IPv4 and IPv6) from checks.
- Smart quota management — Response caching, automatic backoff when the daily quota is exhausted, and no API calls for trusted logged-in users.
- Reverse proxy support — Optional trusted-proxy mode for Cloudflare and load balancers (disabled by default to prevent IP spoofing).
- Accessibility — WCAG-conscious interface: AA contrast in both themes, keyboard navigation, screen reader support, reduced-motion and high-contrast modes.
How It Works
- Once a day (optional), the plugin syncs the AbuseIPDB blacklist locally — the worst 10,000 IPs are blocked instantly with zero API cost.
- When any other IP accesses a sensitive endpoint (login, XML-RPC, comment submission), the plugin queries the AbuseIPDB API.
- If the abuse confidence score meets or exceeds your threshold (default 50/100), the IP is blocked automatically. Whitelisted crawlers like Googlebot are always allowed.
- If multiple failed login attempts are detected from the same IP, it is blocked and reported back to AbuseIPDB, and you can receive an email alert.
- Everything is recorded in a redesigned dashboard with real-time statistics.
API Requirements
A free account at abuseipdb.com is required.
The free plan includes 1,000 checks per day plus daily blacklist downloads — more than enough for most sites when combined with the built-in caching, blacklist sync and smart quota management.
External Services
This plugin connects to the AbuseIPDB API (https://api.abuseipdb.com/api/v2/) to check and report IP addresses.
What is AbuseIPDB?
AbuseIPDB is a community-driven project that maintains a database of IP addresses reported for abusive behavior (spam, hacking, brute-force attacks, etc.). This plugin uses their public API to protect your WordPress site.
What data is sent and when?
- IP address check: When a visitor accesses a sensitive endpoint (wp-login.php, xmlrpc.php, comment submission), the visitor’s IP address is sent to AbuseIPDB to retrieve its abuse confidence score. This only happens when the endpoint is accessed — not on regular page visits.
- IP address report: When a brute-force attack is detected (configurable number of failed login attempts), the offending IP address is reported to AbuseIPDB along with a generic description of the attack. For privacy, your site URL and usernames are NOT included by default (the comment template is customizable). Reporting can be disabled in the plugin settings.
- Blacklist download: If the daily blacklist sync option is enabled, the plugin downloads the AbuseIPDB blacklist once a day. No visitor data is sent in this request.
No personal data other than IP addresses is ever transmitted to AbuseIPDB.
- AbuseIPDB Terms of Service and Privacy Policy: https://www.abuseipdb.com/legal
Privacy Policy
This plugin stores visitor IP addresses in the local WordPress database for the purpose of security logging and blocking. IP addresses are personal data under GDPR.
- What is stored: IP addresses, associated ISP, country, and event type (e.g. blocked, failed login).
- Why: To protect the site from malicious activity and brute-force attacks.
- How long: Log entries are automatically deleted after a configurable retention period (90 days by default, minimum 7). Block entries expire based on the configured duration.
- Third parties: IP addresses may be sent to AbuseIPDB (https://www.abuseipdb.com) for reputation checks and reporting. See the External Services section for details.
- User rights: Site administrators can view and delete all stored data from the plugin’s admin panel or by uninstalling the plugin.
Screenshots
Installation
- Upload the
grantech-ip-firewall-for-abuseipdbfolder to the/wp-content/plugins/directory. - Activate the plugin through the Plugins menu in WordPress.
- Go to IP Shield Settings in the WordPress admin menu and paste your AbuseIPDB API key.
- Adjust the score threshold and brute-force parameters to suit your needs.
- Done — your site is now protected.
Recommended Settings
- Block threshold: 50 (blocks IPs with >50% abuse probability)
- Block duration: 24 hours
- Attempts before block: 5
- Time window: 10 minutes
- API cache: 60 minutes
- Report brute-force: Enabled
FAQ
-
Do I need a paid AbuseIPDB account?
-
No. The free plan includes 1,000 checks per day, which is more than enough for most sites when the caching system is enabled.
-
Will it block legitimate users?
-
It is unlikely. The plugin only queries the API on sensitive endpoints, never on regular page views. IPs on the official AbuseIPDB whitelist (Googlebot, Bingbot, major CDNs) are never blocked, and logged-in users with editing capabilities are skipped entirely, so you cannot lock yourself out of wp-admin. You can also add your own IPs or CIDR ranges to the plugin whitelist — recommended before activating.
-
What if my IP gets blocked?
-
You can log into the admin panel and remove the IP from IP Shield Blocklist. If you cannot access the admin panel, add your IP to the whitelist directly in the database:
UPDATE wp_options SET option_value = 'a:1:{i:0;s:X:"YOUR.IP.HERE";}' WHERE option_name = 'granipfi_whitelist'; -
Is it compatible with Cloudflare?
-
Yes. Enable the “Trust proxy headers” option in Settings and the plugin will read the CF-Connecting-IP header to obtain the real visitor IP. It is disabled by default for security (proxy headers can be spoofed on sites that are not behind a proxy).
-
Can I block IPs manually?
-
Yes. From IP Shield Blocklist you can add any IP with a custom reason. Manual blocks are permanent by default.
-
How do I uninstall cleanly?
-
Deactivate and delete the plugin from the WordPress admin panel. All database tables (
wp_abuseipdb_log,wp_abuseipdb_blocklistandwp_granipfi_blacklist) and options are removed automatically viauninstall.php. -
For Developers
-
The plugin exposes the following hooks:
granipfi_report_comment(filter) — Modify the public comment sent to AbuseIPDB. Receives the comment, the targeted username and the attempt count.granipfi_block_message(filter) — Replace the HTML shown on the 403 block page.granipfi_brute_force_detected(action) — Fires when a brute-force attack is blocked. Receives the IP, username and attempt count.granipfi_access_denied(action) — Fires just before a request is denied. Receives the IP and the internal reason.
Reviews
July 30, 2026
1 reply
Excellent plugin with an outstanding developer!
The plugin works exactly as expected and provides a great integration with AbuseIPDB. It is lightweight, easy to configure, and a valuable addition for improving WordPress security.
What impressed me even more is the developer’s responsiveness. I suggested a privacy improvement in the support forum, and it was implemented in the very next release within just a few days. That’s the kind of support and commitment you rarely see.
Highly recommended if you’re using AbuseIPDB and want to automatically report malicious login attempts while keeping your site protected.
Contributors & Developers
“GranTech IP Firewall for AbuseIPDB” is open source software. The following people have contributed to this plugin.
Contributors
“GranTech IP Firewall for AbuseIPDB” has been translated into 2 locales. Thank you to the translators for their contributions.
Translate “GranTech IP Firewall for AbuseIPDB” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.0
- New: The live IP checker now shows the evidence behind a score — the community’s own recent reports (date, reporter country and comment) in a collapsible panel, plus the resolved hostnames.
- New: IP range scanner (Tools) — check a whole subnet against AbuseIPDB (up to /24 on the free plan), see every reported address sorted by score, and block them individually or all at once with a single button. Blocks respect your configured block duration, skip whitelisted IPs, and you stay on the scan results after blocking.
- New: “Withdraw my reports” tool — deletes the reports your own account submitted for an IP, useful when an address was reported by mistake (e.g. after a proxy misconfiguration).
- New: Configurable report history window (1-365 days, default 90) — lower values focus on currently active threats and reduce false positives.
- New: Configurable blacklist size (100-10,000 IPs) for the daily sync, so small hosting plans can keep the local table light.
- Fix: Removed the WooCommerce
wc-ajaxendpoint from firewall checks — store traffic no longer consumes API quota. - Fix: Readme accuracy — corrected the admin menu name (IP Shield), the full list of protected endpoints, and documented all four public hooks for developers.
1.1.0
- New: One-time dismissible “What’s new” banner on the plugin Dashboard after each update, summarizing the highlights.
- New: Daily AbuseIPDB blacklist sync (opt-in) — downloads the worst-reputation IPs (up to 10,000) once a day into a local table and blocks them instantly on sensitive endpoints, without spending check quota.
- New: The official AbuseIPDB whitelist is now respected — whitelisted IPs (search engine crawlers, major CDNs) are never blocked, preventing false positives like blocking Googlebot.
- New: Richer live IP check — now shows usage type, domain, distinct reporters, last-reported date and whitelist/Tor badges.
- New: Completely redesigned admin interface — modern dual theme (light by default, dark via system preference), GranTech brand identity (teal + navy), status hero on the Dashboard, toggle switches, Dashicons instead of emojis, section navigation in Settings, and refined tables, cards and charts.
- Accessibility: All WCAG improvements preserved and extended — AA contrast verified in both themes, teal focus rings, forced-colors and reduced-motion support, 40px+ touch targets.
- Fix: Live IP check was broken by a JavaScript syntax error — now working again.
- Security: The AbuseIPDB API key is no longer printed in the Settings page HTML source; leave the field empty to keep the saved key.
- Security: Numeric settings are now clamped server-side (e.g. a score threshold of 0 — which would block every visitor — can no longer be saved).
- Fix: Multi-line report comment templates no longer lose their line breaks when saved.
- New: Option to block Tor exit nodes on sensitive endpoints (opt-in), using the isTor flag already returned by the AbuseIPDB API.
- New: AbuseIPDB daily API quota indicator on the Dashboard (remaining/limit with color coding), captured from the API response headers.
- New: Block button directly in the Event Log rows for one-click blocking of suspicious IPs.
- New: Configurable log retention period in Settings (default 90 days, minimum 7).
- Improvement: Automatic backoff when the daily API quota is exhausted (HTTP 429) — API checks pause until the quota resets at midnight UTC, keeping your site fast.
- Improvement: API check timeout reduced from 10s to 5s so visitors never wait long if AbuseIPDB is slow; reports keep the 10s timeout.
- Improvement: Authenticated users with editing capabilities are no longer checked against the API — saves quota and prevents locking yourself out of wp-admin.
- Improvement: Comment IP checks now require the real wp-comments-post.php endpoint, so unrelated forms with a “comment” field no longer trigger API calls.
1.0.5
- New: IP addresses in the Blocklist, Event Log and Dashboard are now clickable — they open the corresponding AbuseIPDB check page (abuseipdb.com/check/{IP}) in a new tab for quick investigation. (Thanks for the suggestion!)
- New: Option to report XML-RPC attacks to AbuseIPDB (opt-in) — IPs exceeding the failed-attempts limit via XML-RPC are reported with categories Brute-Force + Web App Attack, using a vector-specific privacy-safe comment.
- Fix: Added missing translators comments to email notification strings (plugin checker warnings).
1.0.4
- Security: IP detection no longer trusts proxy headers (X-Forwarded-For, CF-Connecting-IP) by default — prevents IP spoofing. New “Trust proxy headers” option for sites behind Cloudflare or a load balancer.
- Privacy: AbuseIPDB report comments no longer include the site URL or targeted username by default — reports are publicly visible on abuseipdb.com.
- New: Customizable report comment template in Settings with placeholders: {attempts}, {window}, {username}, {site}.
- New: granipfi_report_comment filter for developers to programmatically modify report comments.
- New: Email alerts — get notified when a brute-force attack is blocked (throttled to one per attacking IP per hour, configurable recipient).
- New: Dashboard widget — at-a-glance security stats on the main WordPress admin dashboard.
- Fix: “Repair database tables” button now works — the handler was never registered.
- Fix: CIDR whitelist now supports IPv6 ranges (previously IPv4-only).
- Fix: Cron cleanup is rescheduled automatically if it goes missing after a migration.
- Fix: Activation now records DB version to prevent unnecessary table recreation.
- Fix: Added missing event types (xmlrpc_blocked, xmlrpc_probe, report_failed) to the event log filter and styles.
- Fix: Spanish (es_ES) translation completed and aligned with the official WordPress.org es_ES glossary (informar, malintencionado, avisos, Escritorio, ajustes, caduca…).
- Performance: is_blocked() result cached per-IP for 60 seconds — avoids a DB query on every request.
- Performance: Dashboard statistics cached for 5 minutes — avoids 3 heavy GROUP BY queries on every page load.
1.0.3
- Fix: Removed .gitignore file not permitted in WordPress.org plugin repository.
1.0.2
- i18n: Full internationalization — all admin view strings wrapped in __() translation functions.
- i18n: Plugin now displays correctly in any WordPress language based on site settings.
- i18n: English as source language; Spanish (es_ES) loaded automatically via .mo file.
- Fix: Removed remaining hardcoded Spanish strings from all admin views.
- Fix: CSS prefix updated — all classes renamed from shield- to granipfi-.
- Fix: JS global object renamed from AbuseIPDBShield to GranIPFI.
1.0.1
- Fix: Blocklist page showing empty despite IPs being blocked — fixed by adding automatic DB table creation/repair on every plugin load.
- Fix: Added DB version check (granipfi_db_version) to ensure tables are always present and up to date after updates or migrations.
- Improvement: Added database repair tool in Settings page for manual recovery.
- Fix: Admin panel title text color now correctly displays white on dark background.
- Accessibility: Added aria-hidden=”true” to all decorative dashicons.
- Accessibility: Added scope=”col” to all table header cells (17 instances).
- Accessibility: Added aria-label to all data tables.
- Accessibility: Added aria-live=”polite” and aria-atomic to AJAX result region.
- Accessibility: Added role=”status” to success notices and role=”alert” to error notices.
- Accessibility: Added aria-busy state to Verify IP button during async requests.
- Accessibility: Replaced with on IP check input field.
- Accessibility: Added for= attribute to filter labels in event log.
- Accessibility: Added aria-describedby to all settings form fields.
- Accessibility: All font sizes increased to minimum 12px (previously 10-11px).
- Accessibility: Removed outline:none from focus states — now shows visible 2px blue outline.
- Accessibility: Fixed focus-visible selector pointing to non-existent .shield-field class.
- Accessibility: Added focus and focus-visible styles for all interactive elements.
- Accessibility: Added border to score badges and event chips (non-color visual cue, WCAG 1.4.1).
- Accessibility: Added text-decoration:underline to pagination links (WCAG 1.4.1).
- Accessibility: Improved color contrast ratio of muted text: #8b949e #a0aab8 (~5.2:1).
- Accessibility: Added prefers-reduced-motion support — disables transitions/animations.
- Accessibility: Added forced-colors (Windows High Contrast) support with borders and forced-color-adjust.
- Accessibility: Added minimum touch target size 44x44px to buttons and pagination links (WCAG 2.5.8).
- Accessibility: Added screen-reader-text utility class (WordPress standard).
1.0.0
- Initial release.
- Real-time IP checks against the AbuseIPDB v2 API.
- Automatic blocking based on configurable score threshold.
- Brute-force protection for wp-login.php and XML-RPC.
- Automatic reporting of aggressive IPs to AbuseIPDB.
- Admin dashboard with statistics and activity chart.
- Event log with filters.
- Manual blocklist with configurable expiry.
- Whitelist with CIDR range support.
- API response caching via WordPress transients.
- Cloudflare and reverse proxy support.
- Spanish (es_ES) translation included.