Опис

SentraIP filters unwanted visitors before they reach your WordPress application layer. Blocking runs on the WordPress init hook, before your theme and most plugins load, and every lookup is performed locally against offline MMDB database files in your uploads directory — so no external request is made on normal page loads.

The plugin is free and open source (GPLv2 or later), maintained by Move Forward Limited. It works out of the box and no account and no paid plan is ever required to use it.

What it blocks

Country (geolocation) blocking — block visitors by country. You download a free IP-to-country database from a provider of your choice (DB-IP, MaxMind GeoLite2 or IP2Location LITE); your own admin country and your server’s country are excluded automatically so you never lock yourself out.
Bot blocking — block well-known crawlers, scanners and attack tools (Googlebot, GPTBot, SemrushBot, AhrefsBot, ClaudeBot and many more) by User-Agent. Requests with an empty or missing User-Agent can also be blocked.
Spam-comment IP blocking — IPs from comments marked as spam (manually, by bulk action, or by Akismet) are blocked automatically for 24 hours. This needs no external data at all.
Free SPAM reputation dataset (opt-in) — optionally download a free SPAM IP reputation database to block known spam sources. Entirely opt-in, no account required.
IP whitelist — approved IPs and CIDR ranges are never blocked, so you can always guarantee your own access.
Statistics & Blockable Traffic insights — see what was blocked over time, and see allowed traffic that matched a dataset so you can decide what to start filtering.
Blocker Simulator — test what the blocker would do for any IP / User-Agent, without blocking anything.
Configurable response — return 403, 404, 410, 444 or 503 for blocked requests.
Proxy-aware — behind Cloudflare or a reverse proxy, enable “Trust Proxy Headers” so the real visitor IP is used for every check.
Lockout-safe by design — the WordPress admin (/wp-admin), /wp-login.php and /wp-register.php are never blocked, logged-in users are never blocked, and an emergency kill switch (WP_SENTRAIP_DISABLE_BLOCKING) can disable all blocking from wp-config.php.
Secure storage — database files live in a protected uploads subdirectory guarded by .htaccess and index.php.

Advanced datasets (optional add-on)

Additional IP-reputation datasets — VPN, TOR, PROXY, THREAT and Datacenter blocking, per-provider VPN blocklists, and composed AND/OR rules — are available through a separate companion plugin, SentraIP PRO, which connects to a SentraIP account. This free plugin is fully functional on its own and never requires the add-on. See https://sentraip.com for details.

How it works

Choose a geolocation provider on the Geolocation page and download the country database (a monthly WordPress cron keeps it fresh). Configure your rules under Countries, Bots and Settings Blocking Controls. Every request is then checked locally against the offline database files — there is no per-request external call.

External services

To keep visitor lookups fast and offline, this plugin downloads database files from a few third-party services. Understanding which services are contacted, and what data is sent, is important for your privacy and legal compliance. No external request is made on normal visitor page loads — only when a database is downloaded or refreshed, and only for the features you opt into.

Free SPAM dataset (opt-in, no account required)

The free version can download a SentraIP SPAM reputation database to block known spam sources. This is entirely opt-in and needs no API token or account.

What it is used for: downloading and monthly refreshing the free SPAM MMDB database used for blocking.
When data is sent: only after you enable the free SPAM dataset on the SentraIP Settings page. Nothing is downloaded on activation or without your consent, and no request is made on normal visitor page loads.
What data is sent: your site host name and a public key generated for your installation (used to authorise the download). The plugin generates a key pair locally, registers only the public key with SentraIP (app.sentraip.com), and signs each download request; the private key never leaves your server. No visitor IP address or personal data is sent.
If you do not enable it: SPAM blocking still works — IP addresses from comments you mark as spam are blocked automatically, with no external request. The dataset is an optional enhancement, not a requirement.
Service site / terms: https://sentraip.com
Privacy policy: https://www.mforward.eu/privacy-policy/ (Terms: https://sentraip.com/plugin-terms-of-service/)

Sharing spam-comment IPs with SentraIP (opt-in, off by default)

You can optionally let SentraIP collect the IP addresses of comments you mark as spam, to help improve protection for every site using SentraIP.

What it is used for: contributing your spam-comment IPs to SentraIP’s shared reputation data.
When data is sent: only after you tick Share spam IPs with SentraIP on the SentraIP Settings page. It is off by default; with the box unticked nothing is ever shared and the feed endpoint refuses all requests.
What data is sent: only the IP addresses recorded from comments you marked as spam (a ~15-day window). No comment content, author names, e-mails or other personal data are sent. SentraIP reads the list over an authenticated request signed with its own key; your site verifies that signature before responding.
If you do not enable it: spam-comment IP blocking still works locally on your site exactly as before — this option only governs sharing.
Service site / terms: https://sentraip.com
Privacy policy: https://www.mforward.eu/privacy-policy/ (Terms: https://sentraip.com/plugin-terms-of-service/)

Geolocation database providers (opt-in)

Country blocking needs an IP geolocation database, which you download from one free third-party provider that you choose on the SentraIP Geolocation page. No provider is selected by default and no geolocation download happens until you explicitly opt in by choosing one. Once a provider is configured, its database is also refreshed automatically once a month by a WordPress cron job. The database is queried locally on your server; no visitor data is sent to these providers at request time.

DB-IP (https://db-ip.com) — recommended, no registration. Downloads from download.db-ip.com. No credential is sent. Terms: https://db-ip.com/tos.php
MaxMind GeoLite2 (https://www.maxmind.com) — requires a free account. Downloads from download.maxmind.com; your MaxMind license key is sent to authenticate the download. Privacy: https://www.maxmind.com/en/privacy-policy
IP2Location LITE (https://lite.ip2location.com) — requires a free account. Downloads from www.ip2location.com; your IP2Location download token is sent to authenticate the download. Terms: https://www.ip2location.com/terms

See the attribution notes below for the data licences of each provider.

Attributions

Depending on the geolocation provider you choose, this product includes data that requires attribution:

DB-IP: IP Geolocation by DB-IP (https://db-ip.com), licensed under CC-BY 4.0.
MaxMind: This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
IP2Location: This product uses IP2Location LITE data available from https://lite.ip2location.com.

The bundled MaxMind DB reader library is distributed under the Apache License 2.0.

The admin charts are drawn by a small self-contained SVG renderer bundled with the plugin (admin/js/wp-sentraip-charts.js) — no third-party JavaScript charting library is used.

Скріншоти

Dashboard — blocked and blockable traffic charts and the blocker simulator.

Statistics — total blocked traffic over time and a breakdown by type. — Dashboard — blocked and blockable traffic charts and the blocker simulator.

Встановлення

In your WordPress admin go to Plugins Add New Upload Plugin.
Choose the sentraip.zip file and click Install Now, then Activate.
Open SentraIP Geolocation, choose a free IP-to-country provider (DB-IP needs no account) and download the database.
Configure your blocking rules under Countries and Bots, and the master switches under Settings Blocking Controls.
(Optional) On SentraIP Settings, enable the free SPAM reputation dataset.

Manual installation: extract the sentraip folder into /wp-content/plugins/ and activate it from the Plugins menu.

Requirements: PHP 7.4+ and WordPress 6.8+. IP lookups use the MaxMind DB reader, which is bundled with the plugin.

Часті питання

Is the plugin free? Do I need an account?: The plugin is free and open source (GPLv2 or later) and fully functional on its own. Country blocking, bot blocking (with a large built-in list), automatic spam-comment IP blocking, the IP whitelist and the opt-in free SPAM reputation dataset all work with no account at all. Additional IP-reputation datasets (VPN, TOR, PROXY, THREAT, Datacenter and composed rules) are available through the separate SentraIP PRO companion plugin, which connects to a SentraIP account — but this free plugin never requires it.
Will this block my own access?: No. The plugin auto-excludes your server’s country and your saved admin country. The WordPress admin area, the login page (/wp-login.php) and the registration page are never blocked, and logged-in users are never blocked — so you can always sign in and fix a rule. As a last resort you can add define( 'WP_SENTRAIP_DISABLE_BLOCKING', true ); to wp-config.php to disable all blocking.
What happens if the database files are not downloaded yet?: The plugin gracefully skips any check whose database file is missing. Your site keeps working normally until the files are available.
Does the plugin make external requests on every page load?: No. All IP lookups run against local binary database files in your uploads directory. External connections are made only when downloading or refreshing a database file (on a monthly schedule, or when you trigger it manually) — the geolocation database, or the opt-in free SPAM dataset.
Where are the database files stored?: In wp-content/uploads/wp-sentraip/. The directory is protected by a .htaccess (Deny from all) and an index.php to prevent direct web access.
Does it support IPv6?: Yes. The plugin detects whether the visitor’s IP is IPv4 or IPv6 and uses the matching database file, when that version is available for the dataset.
What is the spam comment IP blocking?: When a comment is marked as spam, the commenter’s IP is recorded and blocked for 24 hours. This works entirely locally, with no external data or account.
How do I recover if a rule locks me out?: Open /wp-login.php and sign in — login and /wp-admin are never blocked. Then edit the rule that caught you and remove your country/datacenter/IP. If you cannot reach the admin at all, add define( 'WP_SENTRAIP_DISABLE_BLOCKING', true ); to wp-config.php.

Відгуки

Для цього плагіна немає відгуків.

Учасники та розробники

“SentraIP” — проект з відкритим вихідним кодом. В розвиток плагіну внесли свій вклад наступні учасники:

moveforwardltd

Перекладіть “SentraIP” на вашу мову.

Цікавитесь розробкою?

Перегляньте код, перегляньте сховище SVN або підпишіться на журнал розробки за допомогою RSS.

Журнал змін

1.1.6

All statistics features now work for everyone: the configurable retention, the “Clear all statistics” reset, the full CSV export and the high-rate non-blocked traffic view are no longer restricted — they record and run locally on your own site, so they are part of the free plugin.
Fixed the Privacy Policy and Terms links and the third-party provider links in the readme, which pointed to pages that returned a 404.
SentraIP can now reliably read the spam-comment IP feed even if its own address happens to be on the site’s blocklist: requests genuinely signed by SentraIP (Ed25519, verified against a public key fetched from the service and cached) bypass the block and authorise the feed endpoint. Works with or without a SentraIP account.
Added an explicit opt-in (Settings Security) to share the IPs of comments you mark as spam with SentraIP to improve protection for everyone. It is off by default; with it disabled nothing is shared and the feed endpoint refuses all requests.

1.1.4

Statistics: the Blockable-Traffic timeline query now passes its LIKE pattern through a bound parameter (esc_like), completing the prepared-SQL hardening. No functional change.

1.1.3

Statistics queries now use $wpdb->prepare() with the %i identifier placeholder for table names, fully parameterising every custom query (WordPress.org prepared-SQL compliance). No functional change.

1.1.2

WordPress.org coding-standards compliance: replaced discouraged filesystem calls with the WordPress APIs (wp_delete_file(), WP_Filesystem::move()), replaced mt_rand() with wp_rand(), sanitized all request input inline, prefixed uninstall globals, and audited the statistics table queries. No functional change.

1.1.1

Fixed the Statistics hourly drill-down (click a day bar) always showing “No data”: the hourly rows were matched against formatted “HH:00” labels instead of the raw hour numbers stored in the database, so no bar was ever drawn.
The daily chart/insights cache is now fully cleared on update (including the per-day drill-down entries), so a plugin update never serves data built by the previous version.
Tested up to WordPress 7.1.

1.1.0

SentraIP is now a standalone free plugin: it blocks by country, known bots and custom User-Agent strings, spam-comment IPs (24h), and an opt-in free SPAM reputation dataset — no account required. The paid datasets (VPN, TOR, PROXY, THREAT, Datacenter and composed rules) moved to the separate SentraIP PRO add-on.
Free SPAM dataset: the download now succeeds when the IPv4 file is fetched (the dataset is published as IPv4-only); a missing per-version file is treated as “not published yet” instead of an error.
Rebuilt the blocking pipeline around an extension architecture: each block type is a self-contained extension evaluated by a collect-all pipeline.
The IP whitelist (approved IPs/ranges are never blocked) is now available to everyone.
Scheduled tasks are reconciled automatically after an in-place update — no need to deactivate/reactivate the plugin to pick up newly added cron jobs.
Added a link to sentraip.com on the Dashboard and Settings pages so you can discover the optional SentraIP PRO add-on (shown only when PRO is not installed).
Replaced the bundled Chart.js library with a small self-contained SVG chart renderer, removing a large minified third-party bundle from the plugin.

1.0.25

Fixed ULTRA plan being treated as a lesser tier for advanced statistics: since ULTRA includes everything in PRO, ULTRA accounts now correctly get the granular (hourly + rate) statistics, the retention settings, the reset action, the full data export and the enhanced continent/region/city country view — previously these were shown only to PRO and ULTRA users were downgraded to the free view. The statistics export now also reports the actual plan name.
Replaced all direct cURL calls in the plugin’s own code with the WordPress HTTP API (wp_remote_get) for dataset downloads, resolve probes and the geolocation database download.
Moved the remaining inline admin <script> (Ultra rules data) to wp_add_inline_script().
Hardened IP whitelist validation: CIDR prefix lengths are now checked against the address family (/32 max for IPv4, /128 max for IPv6), so invalid ranges such as 192.0.2.1/64 are rejected.
Removed the explicit load_plugin_textdomain() call; WordPress loads plugin translations automatically.
Translation files (.po/.mo) are no longer bundled — translations are delivered via translate.wordpress.org; only the .pot template ships for translators.
Updated the bundled Chart.js library to 4.5.1.

1.0.24

Fixed Datacenter blocking: the whitelist is now honoured. When Datacenter blocking is enabled in Settings, datacenter IPs are blocked unless their provider name is on the Datacenter whitelist (or belongs to the server’s own datacenter). The check now reads the “full” datacenter dataset (v4 and v6 when installed) as the single source of truth for both membership and the provider name — so the blocker and the dashboard Blocker Simulator behave identically. Previously the name was read from the flag-only “light” file, so the whitelist never matched and every datacenter IP was blocked.
Fixed inconsistent Datacenter blocking between IPv4 and IPv6: when a datacenter IP’s provider name cannot be resolved (e.g. an IPv6 address with no “full” IPv6 dataset), the whitelist cannot be applied, so the request is now allowed instead of being silently blocked. This makes IPv6 behave like IPv4 for whitelisted providers.
The downloader now also fetches the “full” IPv6 datasets for VPN and Datacenter when the SentraIP API publishes them, so provider/datacenter names can be resolved for IPv6 clients and the whitelist works fully on IPv6. Previously only the “full” IPv4 file was downloaded.
Compliance with the WordPress.org Plugin Directory guidelines:
Renamed the plugin to “SentraIP” (text domain “sentraip”) so the name and directory slug no longer begin with the reserved term “wp”.
Documented the freemium model: the plugin is GPL and free; TOR and SPAM datasets are available on the free SentraIP account, other datasets on paid plans. The free account now grants the TOR and SPAM datasets by default.
Removed the duplicate TOR/SPAM/PROXY/THREAT toggles from the Rules page; these are managed under Settings Blocking Controls.
Added leakix, the l9 scanner family and many other scanner/attack tool signatures to the default bot list.
Chart.js is now bundled with the plugin and served locally instead of being loaded from an external CDN.
Geolocation is now fully opt-in: no provider is selected by default and no third-party geolocation database is downloaded until you choose a provider on the Geolocation page.
Expanded the “External services” documentation: geolocation download hosts (DB-IP, MaxMind, IP2Location), when they are contacted, and which credentials are sent; documented the optional spam-IP REST feed.
Added Apache-2.0 licence notices to the bundled MaxMind DB reader files.
Trimmed the bundled MaxMind reader to the pure-PHP library actually used at runtime: the build now excludes the native C extension source, its .phpt tests and package metadata (no development tools shipped), while keeping all required LICENSE/NOTICE files.
Fixed the STARTER plan to grant TOR, SPAM and PROXY, matching the official SentraIP plans.
Updated “Requires at least” (6.8) and “Tested up to” (7.0).

1.0.23

Fixed the VPN and Datacenter provider lists, which were empty: provider/datacenter names live only in the full dataset (fields vpn_provider / organization), while the light file used for blocking carries just a membership flag. The plugin now downloads the full v4 file for VPN and Datacenter and enumerates names from it (IPv4 only).

1.0.22

Added the required readme.txt and a full GPLv2 LICENSE file for the WordPress.org Plugin Directory.
Hardened output escaping across admin pages and switched uninstall queries to prepared statements.
Namespaced cache keys (transients) and completed cron cleanup on uninstall.
Removed unused admin pages and their dead handlers/assets.

1.0.21

Dataset-driven architecture: blocking and configuration pages now follow the datasets your token grants, not the plan name.
Retention by entitlement: installed database files for granted datasets are never deleted when a listing is empty or partial.
Downloader reads available IP versions (ip_versions) and only fetches files that exist.
Configurable retention (7–90 days, default 30) for Blockable Traffic data.
Settings: removed the “External Services” and “SentraIP API” boxes.
Recovery: /wp-admin, /wp-login.php and /wp-register.php are never blocked, even when your IP is in a blocklist; the site frontend stays protected.
Updated Italian, Spanish, French and German translations.

1.0.9

Blockable Traffic (Insights) page, Blocker Simulator, recovery section and translations.

1.0.2

Spam comment IP collector — blocks IPs from spam comments for 24 hours.
REST debug endpoint for testing the blocking pipeline.
Bot check now blocks requests with empty or missing User-Agent.

1.0.0

Initial release: country and bot blocking, reputation datasets, VPN/Datacenter blocking, composed rules, statistics dashboard and internationalization.