GranTech IP Firewall for AbuseIPDB

1.3.0

• New: AbuseIPDB contributor badge — show it with the [granipfi_badge] shortcode or the “AbuseIPDB Contributor Badge” widget. Sites that link to AbuseIPDB can request “supporter” status (with higher daily API limits) by contacting AbuseIPDB; it is not granted automatically. Fully opt-in: nothing is shown until you enter your user ID and place the shortcode or widget.
• New: Opt-in reporting of comment spammers to AbuseIPDB (Blog Spam category). Only comments actually classified as spam are reported — on submission by an anti-spam filter such as Akismet, or when a moderator marks them as spam. Registered users and private IP ranges are never reported, and the comment text is never sent.
• Improvement: Login brute-force reports now use categories 18 + 21 (Brute-Force + Web App Attack), as AbuseIPDB recommends for attacks on WordPress.
• Improvement: Destructive actions (remove from blocklist, block a whole range, withdraw reports) now use accessible inline confirmations instead of native browser dialogs. This also removes the remaining inline JavaScript handlers and translates a confirmation message that was hardcoded in English.
• New: Catalan (ca) translation.

1.2.0

• New: The live IP checker now shows the evidence behind a score — the community’s own recent reports (date, reporter country and comment) in a collapsible panel, plus the resolved hostnames.
• New: IP range scanner (Tools) — check a whole subnet against AbuseIPDB (up to /24 on the free plan), see every reported address sorted by score, and block them individually or all at once with a single button. Blocks respect your configured block duration, skip whitelisted IPs, and you stay on the scan results after blocking.
• New: “Withdraw my reports” tool — deletes the reports your own account submitted for an IP, useful when an address was reported by mistake (e.g. after a proxy misconfiguration).
• New: Configurable report history window (1-365 days, default 90) — lower values focus on currently active threats and reduce false positives.
• New: Configurable blacklist size (100-10,000 IPs) for the daily sync, so small hosting plans can keep the local table light.
• Fix: Removed the WooCommerce wc-ajax endpoint from firewall checks — store traffic no longer consumes API quota.
• Fix: Readme accuracy — corrected the admin menu name (IP Shield), the full list of protected endpoints, and documented all four public hooks for developers.

1.1.0

• New: One-time dismissible “What’s new” banner on the plugin Dashboard after each update, summarizing the highlights.
• New: Daily AbuseIPDB blacklist sync (opt-in) — downloads the worst-reputation IPs (up to 10,000) once a day into a local table and blocks them instantly on sensitive endpoints, without spending check quota.
• New: The official AbuseIPDB whitelist is now respected — whitelisted IPs (search engine crawlers, major CDNs) are never blocked, preventing false positives like blocking Googlebot.
• New: Richer live IP check — now shows usage type, domain, distinct reporters, last-reported date and whitelist/Tor badges.
• New: Completely redesigned admin interface — modern dual theme (light by default, dark via system preference), GranTech brand identity (teal + navy), status hero on the Dashboard, toggle switches, Dashicons instead of emojis, section navigation in Settings, and refined tables, cards and charts.
• Accessibility: All WCAG improvements preserved and extended — AA contrast verified in both themes, teal focus rings, forced-colors and reduced-motion support, 40px+ touch targets.
• Fix: Live IP check was broken by a JavaScript syntax error — now working again.
• Security: The AbuseIPDB API key is no longer printed in the Settings page HTML source; leave the field empty to keep the saved key.
• Security: Numeric settings are now clamped server-side (e.g. a score threshold of 0 — which would block every visitor — can no longer be saved).
• Fix: Multi-line report comment templates no longer lose their line breaks when saved.
• New: Option to block Tor exit nodes on sensitive endpoints (opt-in), using the isTor flag already returned by the AbuseIPDB API.
• New: AbuseIPDB daily API quota indicator on the Dashboard (remaining/limit with color coding), captured from the API response headers.
• New: Block button directly in the Event Log rows for one-click blocking of suspicious IPs.
• New: Configurable log retention period in Settings (default 90 days, minimum 7).
• Improvement: Automatic backoff when the daily API quota is exhausted (HTTP 429) — API checks pause until the quota resets at midnight UTC, keeping your site fast.
• Improvement: API check timeout reduced from 10s to 5s so visitors never wait long if AbuseIPDB is slow; reports keep the 10s timeout.
• Improvement: Authenticated users with editing capabilities are no longer checked against the API — saves quota and prevents locking yourself out of wp-admin.
• Improvement: Comment IP checks now require the real wp-comments-post.php endpoint, so unrelated forms with a “comment” field no longer trigger API calls.

1.0.5

• New: IP addresses in the Blocklist, Event Log and Dashboard are now clickable — they open the corresponding AbuseIPDB check page (abuseipdb.com/check/{IP}) in a new tab for quick investigation. (Thanks for the suggestion!)
• New: Option to report XML-RPC attacks to AbuseIPDB (opt-in) — IPs exceeding the failed-attempts limit via XML-RPC are reported with categories Brute-Force + Web App Attack, using a vector-specific privacy-safe comment.
• Fix: Added missing translators comments to email notification strings (plugin checker warnings).

1.0.4

• Security: IP detection no longer trusts proxy headers (X-Forwarded-For, CF-Connecting-IP) by default — prevents IP spoofing. New “Trust proxy headers” option for sites behind Cloudflare or a load balancer.
• Privacy: AbuseIPDB report comments no longer include the site URL or targeted username by default — reports are publicly visible on abuseipdb.com.
• New: Customizable report comment template in Settings with placeholders: {attempts}, {window}, {username}, {site}.
• New: granipfi_report_comment filter for developers to programmatically modify report comments.
• New: Email alerts — get notified when a brute-force attack is blocked (throttled to one per attacking IP per hour, configurable recipient).
• New: Dashboard widget — at-a-glance security stats on the main WordPress admin dashboard.
• Fix: “Repair database tables” button now works — the handler was never registered.
• Fix: CIDR whitelist now supports IPv6 ranges (previously IPv4-only).
• Fix: Cron cleanup is rescheduled automatically if it goes missing after a migration.
• Fix: Activation now records DB version to prevent unnecessary table recreation.
• Fix: Added missing event types (xmlrpc_blocked, xmlrpc_probe, report_failed) to the event log filter and styles.
• Fix: Spanish (es_ES) translation completed and aligned with the official WordPress.org es_ES glossary (informar, malintencionado, avisos, Escritorio, ajustes, caduca…).
• Performance: is_blocked() result cached per-IP for 60 seconds — avoids a DB query on every request.
• Performance: Dashboard statistics cached for 5 minutes — avoids 3 heavy GROUP BY queries on every page load.

1.0.3

• Fix: Removed .gitignore file not permitted in WordPress.org plugin repository.