Hikosachi Protector

Description

Hikosachi Protector connects your site to Hikosachi, a threat intelligence service operated in Japan. Attacks detected on participating sites (password guessing, vulnerability scans, malicious uploads) are collected, evaluated, and shared back as a blocklist, so every site benefits from what the others have seen.

This plugin requires the Hikosachi service. It does not connect to the service until you either enter an API key or choose the free public blocklist on the settings page. See “External services” below for exactly what is sent.

Features

• IP blocking – Requests from IP addresses on the Hikosachi blocklist receive a 403 response. The list is updated every hour.
• Login protection – Failed logins and failed Application Password authentications are detected and, with an API key, reported to the network.
• XML-RPC blocking – Requests to xmlrpc.php, a common target of password guessing, are refused.
• Upload attack detection – Attempts by visitors (or low-privilege users) to upload PHP files, requests for PHP files under wp-content/uploads, and path traversal patterns are refused.
• Vulnerability alerts (optional, API key required) – Your installed plugin and theme versions are checked against a vulnerability database, and you are notified by email if your site is affected.
• Dashboard and login only from Japan (optional, Professional plan or higher) – Refuses access to wp-admin and wp-login.php from IP addresses outside Japan, with an allowlist for your own addresses.
• WP-Cron diagnosis – If scheduled updates stop running, the settings page explains the likely cause (Basic authentication, DISABLE_WP_CRON, WAF, redirects), and the blocklist keeps updating as a backup when the site has visitors.
• Site badge (optional, off by default) – A small “Protected by Hikosachi” badge you can choose to show.

Free and paid use

• Free public blocklist – No account needed. Check “Use the free public blocklist” on the settings page.
• API key – With a Hikosachi account, the site receives the full blocklist and reports the attacks it detects, which improves the list for everyone. Vulnerability alerts and the Japan-only restriction are provided by the service on the plans listed at hikosachi.com.

All code in this plugin is included and active. Paid plans change what the Hikosachi service provides, not what the plugin can do.

External services

This plugin connects to the Hikosachi service (https://hikosachi.com/), operated by inexio LLC (アイネクシオ合同会社), Japan. Nothing is sent to the service until you enter an API key or enable the free public blocklist on Settings > Hikosachi.

• Terms of service: https://hikosachi.com/terms.php
• Privacy policy: https://hikosachi.com/privacy.php

1. Blocklist download

• Endpoint: https://hikosachi.com/api/feed.php
• When: Right after you save the settings, every hour via WP-Cron, when you press “Update the blocklist now”, and as a backup at the end of a page view if the last download was more than 2 hours ago.
• Data sent: Your API key (if entered) and a User-Agent header containing the plugin version and your site URL (home_url). The site URL is used to count the number of sites on your plan.

2. Attack reports (API key only)

• Endpoint: https://hikosachi.com/api/report.php
• When: When the plugin detects a failed login, a failed Application Password authentication, a request to xmlrpc.php, an upload attack pattern, or an access from a blocked IP address.
• Data sent: Your API key, the IP address of the request, the attack type, the requested URL (including its query string), and the User-Agent of the request. Reported IP addresses are evaluated and may be added to the blocklist shared with other users. Usernames, passwords, and information about members or customers are not sent.

3. Vulnerability alerts (API key only, off by default)

• Endpoint: https://hikosachi.com/api/inventory.php
• When: Once a day and about one minute after plugins or themes are installed, updated, activated, deactivated, or deleted – only after you enable “Vulnerability alerts”.
• Data sent: Your API key, the site URL, the WordPress, PHP, and plugin versions, and the slug, version, and active state of every installed plugin and theme.

4. IP ranges for Japan (API key only, off by default)

• Endpoint: https://hikosachi.com/api/country-ranges.php
• When: When you enable “Allow the dashboard and login only from Japan” and then once a day, only while that option is enabled.
• Data sent: Your API key and a User-Agent header containing the plugin version and your site URL. The ranges are derived from the public allocation records of APNIC.

Connections to your own site

When the settings page shows that WP-Cron is not running, the plugin sends one request from your server to your own wp-cron.php to find out why. The request has a dummy POST body, which makes WordPress exit before running any tasks, and only the HTTP status code is used. No data leaves your site.