Atlant Security vs IP Geo Block

Atlant Security is a comprehensive WordPress security plugin that provides enterprise-grade protection through 17 integrated security modules organized in a 5-layer defense architecture. 5-Layer Defense Architecture Early-Request WAF – Firewall, rate limiter, and IP blocking inspect every request at init priority 0, early in WordPress’s load – before the page is queried or rendered and before other plugins process the request. Application-Aware – Login security, custom login URL, two-factor authentication, session hardening, cron monitoring, and REST API policies. Content & Config – WordPress hardening, security headers, AI crawler management, and honeypot traps. Outbound & Data – SSRF prevention, malware scanning (files and database). Response & Recovery – Post-breach recovery, notifications, visitor log, and audit log. Key Features Web Application Firewall (WAF) Inspects every request against 28+ attack pattern families including SQL injection, XSS, remote code execution, path traversal, PHP object injection, and WordPress-specific attacks. Block or log-only mode. Triple URL decoding prevents evasion. Brute Force Protection Progressive lockout system (5 min > 30 min > 24 hours) with configurable thresholds. Generic login error messages prevent username enumeration. Author enumeration blocking. Malware Scanner Local file and database scanner with 38 malware signatures. Detects backdoors, webshells (WSO, c99, r57), crypto miners, credit card skimmers, and obfuscated code. Quarantine system with web access blocking. Two-Factor Authentication (2FA) TOTP (Google Authenticator, Authy) and email OTP. Per-role enforcement, 10 recovery codes, 5-minute challenge timeout, replay attack prevention. Honeypot Traps Zero-false-positive bot detection: hidden link traps, fake login pages, comment honeypots, and Contact Form 7 integration. 3-layer safe bot protection ensures Googlebot, Bingbot, and allowed AI crawlers are never blocked. AI Crawler Management Control 20+ known AI/LLM training crawlers (GPTBot, ClaudeBot, Google-Extended, Bytespider, and more). Per-crawler toggles, robots.txt integration, and 403 enforcement. Block training crawlers while allowing browsing bots. Security Headers Manage HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP, CORP, and COOP. Letter-grade scoring system. Remove X-Powered-By and Server headers. Session Security Cookie hardening (HttpOnly, Secure, SameSite). Session binding via IP + User-Agent fingerprint detects hijacking. Concurrent session limits. Idle timeout. Optional admin bypass for all session restrictions. Rate Limiter Sliding-window rate limiting across 11 endpoint categories: frontend, login, search, feed, REST API, WooCommerce checkout, XML-RPC, and cron. REST API Policies Per-route access control with authentication requirements, HTTP method restrictions, rate limits, and IP whitelists. 5 built-in policies protect user enumeration, search, and write endpoints. Cron Guard Monitors wp-cron.php for flood attacks. Detects suspicious scheduled tasks via baseline comparison. System cron migration helper. Outbound Monitor (SSRF Prevention) Monitors all outgoing HTTP requests. Blocks requests to private/internal IP ranges including cloud metadata endpoints. Domain allowlist with wildcard support. Caller detection traces requests to specific plugins. Post-Breach Recovery 12 emergency actions: terminate sessions, force password reset, rotate secret keys, emergency lockdown, reinstall core, reinstall plugins, audit admin accounts, clear caches, malware scan, disable plugins, and downloadable incident report. Real-Time Dashboard Live visitor monitoring with 15-second auto-refresh. Stat cards, traffic charts, top IPs with VirusTotal integration, browser distribution, and IP detail modals. Visitor Log & Audit Log Complete request history with filters (IP, URL, bots, blocked, time range). Tamper-resistant admin action audit trail. Notifications Email alerts (HTML formatted, color-coded severity), Slack webhooks, custom JSON webhooks, and daily digest. Configurable severity threshold with 5-minute deduplication. WordPress Hardening One-click toggles: disable XML-RPC, hide WordPress version, block REST API user enumeration, block author enumeration, disable file editor, block PHP execution in uploads. What Makes Atlant Security Different Early-Request WAF – Inspects and blocks malicious requests at init priority 0, before the page renders and before other plugins handle the request Outbound HTTP Monitor – Detects SSRF attacks and unauthorized outbound connections Database Backdoor Scanner – Scans wp_options and wp_posts for eval(), base64, and hidden backdoors Client-Side Bot Detection – JavaScript challenges and browser fingerprinting catch sophisticated bots AI/LLM Crawler Blocking – Identify and block AI training crawlers scraping your content Honeypot Traps – Hidden links, fake login pages, invisible form fields that only bots trigger Cron Guard – Monitors wp-cron for unauthorized scheduled tasks planted by malware Post-Breach Recovery – Guided recovery toolkit with 12 emergency actions in one place Session Fingerprint Binding – Binds sessions to IP + User-Agent so stolen cookies are useless Real-Time Visitor Dashboard – Live visitor feed updated every 15 seconds Smart Password Policy – Minimum length, complexity, common-password blocking, and passphrase support Granular REST API Policies – Per-endpoint control, not just a global on/off switch Safe Mode Override – One constant in wp-config.php disables all blocking features instantly Deactivation Data Control – Choose to keep or wipe all security data when deactivating Zero phone-home – No telemetry, no tracking, fully GDPR-compliant (external services used only when explicitly enabled by the admin – see External Services section) Why Atlant Security? All-in-one – Replaces 5-6 separate security plugins No external dependencies – Core security features run locally on your server Zero phone-home – No telemetry, no tracking (optional features like GeoIP use external services only when explicitly enabled – see External Services section) GDPR-friendly – No external fonts, no CDN resources Setup wizard – Configure core security in under 2 minutes Clean uninstall – Removes all database tables and options when deleted (opt-in) Safe Mode – Emergency override if you get locked out of your site External Services This plugin connects to the following third-party services under specific conditions: Cloudflare IP Ranges When Cloudflare integration is enabled, the plugin periodically fetches the current list of Cloudflare edge IP ranges from Cloudflare’s official endpoints. This is used to correctly identify visitor IP addresses behind the Cloudflare proxy and to whitelist Cloudflare edge servers. Data sent: No user data is sent. The plugin fetches publicly available IP range lists. When: Once per week via a scheduled cron job (aswp_refresh_cloudflare_ips), only when Cloudflare integration is enabled. Endpoints: https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6 Cloudflare Terms of Use Cloudflare Privacy Policy MaxMind GeoLite2 GeoIP Database When GeoIP country detection is enabled and a MaxMind license key is configured, the plugin downloads the GeoLite2-Country database from MaxMind. This database is stored locally and used to resolve visitor IP addresses to country codes for display in the visitor log and dashboard. Data sent: Your MaxMind license key is sent to authenticate the download request. No visitor data is sent to MaxMind. When: On initial setup and once per week via a scheduled cron job (aswp_update_geoip_db), only when GeoIP is enabled and a license key is configured. Endpoint: https://download.maxmind.com/app/geoip_download MaxMind End User License Agreement MaxMind Privacy Policy Google IP Ranges When Google integration is enabled in the IP Whitelist, the plugin periodically fetches the current list of Google IP ranges from Google’s official endpoint. This is used to automatically whitelist known Google infrastructure IPs (Googlebot, Google Cloud, etc.) so legitimate Google traffic is never blocked. Data sent: No user data is sent. The plugin fetches a publicly available JSON file containing Google IP ranges. When: Once per week via a scheduled cron job (aswp_refresh_google_ips), only when Google integration is enabled. Endpoint: https://www.gstatic.com/ipranges/goog.json Google Terms of Service Google Privacy Policy Microsoft / Bing IP Ranges When Microsoft integration is enabled in the IP Whitelist, the plugin periodically fetches the current list of Bing bot IP ranges from Microsoft’s official endpoint. This is used to automatically whitelist known Bing crawler IPs so legitimate Bing traffic is never blocked. Data sent: No user data is sent. The plugin fetches a publicly available JSON file containing Bing bot IP ranges. When: Once per week via a scheduled cron job (aswp_refresh_microsoft_ips), only when Microsoft integration is enabled. Endpoint: https://www.bing.com/toolbox/bingbot.json Microsoft Services Agreement Microsoft Privacy Statement WordPress.org Core Checksums API The Malware Scanner verifies the integrity of WordPress core files by comparing their MD5 hashes against the official checksums published by WordPress.org. Files that match are skipped during pattern scanning (vendor-verified, safe by definition). Files that mismatch are flagged as critical “core_modified” findings. Data sent: WordPress version number and locale. No site data, no visitor data, no PII. When: Once per WordPress version (cached for 24 hours), only when the Malware Scanner runs and the “Use core checksums” setting is enabled. Endpoint: https://api.wordpress.org/core/checksums/1.0/ WordPress.org Terms of Service WordPress.org Privacy Policy WordPress.org Secret Key API The Post-Breach Recovery module can generate new WordPress secret keys and salts using the official WordPress.org API. This is used when an administrator manually triggers the “Rotate Secret Keys” emergency action after a security breach. Data sent: No user data is sent. The plugin fetches randomly generated keys from the API. When: Only when an administrator manually triggers the “Rotate Secret Keys” action in the Post-Breach Recovery module. Endpoint: https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org Terms of Service WordPress.org Privacy Policy Slack Webhooks When Slack notifications are enabled and a Slack webhook URL is configured, the plugin sends security alert messages to the specified Slack channel. This allows administrators to receive real-time security notifications in Slack. Data sent: Security alert messages containing the alert subject, description, severity level, site URL, and the IP address that triggered the alert. No visitor personal data or cookies are sent. When: Only when a security event occurs (e.g., brute force attempt, WAF block, honeypot trip) and Slack notifications are enabled. Endpoint: Administrator-configured Slack Incoming Webhook URL (e.g., https://hooks.slack.com/services/…) Slack Terms of Service Slack Privacy Policy Custom Webhooks When webhook notifications are enabled and a webhook URL is configured, the plugin sends security alert payloads in JSON format to the specified endpoint. This allows integration with any external monitoring or alerting system. Data sent: JSON payload containing the alert subject, description, severity level, site URL, timestamp, and the IP address that triggered the alert. No visitor personal data or cookies are sent. When: Only when a security event occurs and webhook notifications are enabled. Endpoint: Administrator-configured webhook URL. Terms and privacy: Determined by the third-party service the administrator configures. Google reCAPTCHA When CAPTCHA bot protection is enabled and the provider is set to “Google reCAPTCHA v2” or “Google reCAPTCHA v3”, visitor browsers load Google’s reCAPTCHA library and the server verifies submitted tokens with Google. This is OPT-IN – disabled by default. Data sent (browser → Google): visitor IP address and standard reCAPTCHA telemetry that Google uses to score human-vs-bot likelihood. Google’s reCAPTCHA library is loaded from www.google.com/recaptcha/api.js. Data sent (server → Google): the verification token returned by the visitor’s browser, the configured secret key, and the visitor’s IP address (remoteip field), to https://www.google.com/recaptcha/api/siteverify. When: only when the configured provider is reCAPTCHA AND the visitor reaches /wp-login.php, the WordPress registration form, or the lost-password form (per-form toggle). Endpoints: https://www.google.com/recaptcha/api.js and https://www.google.com/recaptcha/api/siteverify Google reCAPTCHA Terms of Service Google Privacy Policy Cloudflare Turnstile When CAPTCHA bot protection is enabled and the provider is set to “Cloudflare Turnstile”, visitor browsers load Cloudflare’s Turnstile library and the server verifies submitted tokens with Cloudflare. This is OPT-IN – disabled by default. Turnstile is the privacy-respecting alternative to reCAPTCHA – Cloudflare states it does NOT track users across sites. Data sent (browser → Cloudflare): visitor IP address and standard Turnstile telemetry. The Turnstile library is loaded from challenges.cloudflare.com/turnstile/v0/api.js. Data sent (server → Cloudflare): the verification token returned by the visitor’s browser, the configured secret key, and the visitor’s IP address (remoteip field), to https://challenges.cloudflare.com/turnstile/v0/siteverify. When: only when the configured provider is Cloudflare Turnstile AND the visitor reaches /wp-login.php, the WordPress registration form, or the lost-password form (per-form toggle). Endpoints: https://challenges.cloudflare.com/turnstile/v0/api.js and https://challenges.cloudflare.com/turnstile/v0/siteverify Cloudflare Terms of Service Cloudflare Privacy Policy Upgrade Notices 1.1.8 Restores the policy: legitimate vendor bots (Google, Anthropic, OpenAI, Bing) are NEVER blocked unless the site operator explicitly opts in. Two fixes – AI crawler defaults flipped to “allow”, and the Honeypot reverse-DNS check now fails open so transient DNS issues can’t ban real Googlebots. Recommended for everyone running an SEO-sensitive site. 1.1.7 Critical security release. Fixes 14 CRITICAL and 12 HIGH issues found during a full external audit, including a fatal-at-login bug, IP-block bypass via IPv6-mapped addresses, an SSRF DNS-rebinding race in the outbound monitor, and a wp-config-backup-leaks-old-keys flaw. Recommended upgrade for every install. 1.1.6 Big scanner-accuracy improvement. Verified WordPress core files are now skipped (MD5-matched against the official api.wordpress.org checksums), tightened iframe/base64 signatures, fixed an over-broad path match, and added a “Mark as False Positive” button. Recommended upgrade for everyone running scans. 1.1.5 Adds CAPTCHA support on login / registration / lost-password forms. Three providers: reCAPTCHA v2, reCAPTCHA v3, and Cloudflare Turnstile. Configure in Login Security → Bot Protection (CAPTCHA). 1.1.4 Adds CSV export on the Malware Scanner (per Reddit community suggestion) – download full untruncated File + Database Findings before committing to Quarantine. Compatibility declared through WP 7.0. 1.1.3 Security hardening release. Fixes custom-login-URL cookie bypass, 2FA enforcement, SSRF log-only default, session-limit token/verifier mix, and adds real wp-config.php rewriting for key rotation. Existing 2FA recovery codes generated before 1.1.3 may not verify – regenerate them from your user profile after upgrading. 1.1.2 New About page consolidates defense architecture and competitive features. Setup wizard no longer auto-redirects on activation. Dashboard is cleaner with focus on operational data. 1.0.7 Major UI overhaul: inner sidebar navigation replaces 23 WordPress submenu items with a clean, persistent sidebar panel. All page URLs remain the same – bookmarks still work. 1.0.4 Adds GeoIP country flags in visitor log, custom login URL, password policy enforcement, and Force SSL Admin setting. Internal prefix migration runs automatically – no action required. 1.0.3 Adds honeypot traps, security headers management, two-factor authentication, and notification channels. Fixes IP management and status code logging. Recommended update. 1.0.0 Initial release. Run the Setup Wizard after activation to configure your site’s security.

The more you install themes and plugins, the more likely your sites will be vulnerable, even if you securely harden your sites. While WordPress.org provides excellent resources, themes and plugins may often get vulnerable due to developers’ human factors such as lack of security awareness, misuse and disuse of the best practices in those resources. This plugin focuses on insights into such developers’ human factors instead of detecting the specific attack vectors after they were disclosed. This brings a smart and powerful methods named as “WP Zero-day Exploit Prevention” and “WP Metadata Exploit Protection“. Combined with those methods and IP address geolocation, you’ll be surprised to find a bunch of malicious or undesirable access blocked in the logs of this plugin after several days of installation. Features Privacy by design: IP address is always encrypted on recording in logs/cache. Moreover, it can be anonymized and restricted on sending to the 3rd parties such as geolocation APIs or whois service. Immigration control: Access to the basic and important entrances into back-end such as wp-comments-post.php, xmlrpc.php, wp-login.php, wp-signup.php, wp-admin/admin.php, wp-admin/admin-ajax.php, wp-admin/admin-post.php will be validated by means of a country code based on IP address. It allows you to configure either whitelist or blacklist to specify the countires, CIDR notation for a range of IP addresses and AS number for a group of IP networks. Zero-day Exploit Prevention: Unlike other security firewalls based on attack patterns (vectors), the original feature “WordPress Zero-day Exploit Prevention” (WP-ZEP) is focused on patterns of vulnerability. It is simple but still smart and strong enough to block any malicious accesses to wp-admin/*.php, plugins/*.php and themes/*.php even from the permitted countries. It will protect your site against certain types of attack such as CSRF, LFI, SQLi, XSS and so on, even if you have some vulnerable plugins and themes in your site. Guard against login attempts: In order to prevent hacking through the login form and XML-RPC by brute-force and the reverse-brute-force attacks, the number of login attempts will be limited per IP address even from the permitted countries. Minimize server load against brute-force attacks: You can configure this plugin as a Must Use Plugins so that this plugin can be loaded prior to regular plugins. It can massively reduce the load on server. Prevent malicious down/uploading: A malicious request such as exposing wp-config.php or uploading malwares via vulnerable plugins/themes can be blocked. Block badly-behaved bots and crawlers: A simple logic may help to reduce the number of rogue bots and crawlers scraping your site. Support of BuddyPress and bbPress: You can configure this plugin so that a registered user can login as a membership from anywhere, while a request such as a new user registration, lost password, creating a new topic and subscribing comment can be blocked by country. It is suitable for BuddyPress and bbPress to help reducing spams. Referrer suppressor for external links: When you click an external hyperlink on admin screens, http referrer will be eliminated to hide a footprint of your site. Multiple source of IP Geolocation databases: MaxMind GeoLite2 free databases (it requires PHP 5.4.0+) and IP2Location LITE databases can be installed in this plugin. Also free Geolocation REST APIs and whois information can be available for audit purposes. Father more, dedicated API class libraries can be installed for CloudFlare and CloudFront as a reverse proxy service. Customizing response: HTTP response code can be selectable as 403 Forbidden to deny access pages, 404 Not Found to hide pages or even 200 OK to redirect to the top page. You can also have a human friendly page (like 404.php) in your parent/child theme template directory to fit your site design. Validation logs: Validation logs for useful information to audit attack patterns can be manageable. Cooperation with full spec security plugin: This plugin is lite enough to be able to cooperate with other full spec security plugin such as Wordfence Security. See this report about page speed performance. Extendability: You can customize the behavior of this plugin via add_filter() with pre-defined filter hook. See various use cases in samples.php bundled within this package. You can also get the extension IP Geo Allow by Dragan. It makes admin screens strictly private with more flexible way than specifying IP addresses. Self blocking prevention and easy rescue: Website owners do not prefer themselves to be blocked. This plugin prevents such a sad thing unless you force it. And futhermore, if such a situation occurs, you can rescue yourself easily. Clean uninstallation: Nothing is left in your precious mySQL database after uninstallation. So you can feel free to install and activate to make a trial of this plugin’s functionality. Attribution This package includes GeoLite2 library distributed by MaxMind, available from MaxMind (it requires PHP 5.4.0+), and also includes IP2Location open source libraries available from IP2Location. Also thanks for providing the following great services and REST APIs for free. http://ip-api.com/ (IPv4, IPv6 / free for non-commercial use) http://geoiplookup.net/ (IPv4, IPv6 / free) https://ipinfo.io/ (IPv4, IPv6 / free) [https://ipapi.com/](https://ipapi.com/ “ipapi – IP Address Lookup and Geolocation API) (IPv4, IPv6 / free, need API key) https://ipdata.co/ (IPv4, IPv6 / free, need API key) https://ipstack.com/ (IPv4, IPv6 / free for registered user, need API key) https://ipinfodb.com/ (IPv4, IPv6 / free for registered user, need API key) Development Development of this plugin is promoted at WordPress-IP-Geo-Block and class libraries to handle geo-location database are developed separately as “add-in”s at WordPress-IP-Geo-API. All contributions will always be welcome. Or visit my development blog. Known issues No image is shown after drag & drop a image in grid view at “Media Library”. For more details, please refer to this ticket at Github. From WordPress 4.5, rel=nofollow had no longer be attached to the links in comment_content. This change prevents to block “Server Side Request Forgeries” (not Cross Site but a malicious internal link in the comment field). WordPress.com Mobile App can’t execute image uploading because of its own authentication system via XMLRPC.