Title: Hikosachi Protector Author: TAKAHIRO Published: November 12, 2026 Last modified: November 12, 2026 --- Search plugins ![](https://ps.w.org/hikosachi-protector/assets/icon.svg?rev=3798016) # Hikosachi Protector By [TAKAHIRO](https://profiles.wordpress.org/grooveline/) [Download](https://downloads.wordpress.org/plugin/hikosachi-protector.3.6.1.zip) * [Details](https://wordpress.org/plugins/hikosachi-protector/#description) * [Reviews](https://wordpress.org/plugins/hikosachi-protector/#reviews) * [Installation](https://wordpress.org/plugins/hikosachi-protector/#installation) * [Development](https://wordpress.org/plugins/hikosachi-protector/#developers) [Support](https://wordpress.org/support/plugin/hikosachi-protector/) ## Description Hikosachi Protector connects your site to [Hikosachi](https://hikosachi.com/), a threat intelligence service operated in Japan. Attacks detected on participating sites (password guessing, vulnerability scans, malicious uploads) are collected, evaluated, and shared back as a blocklist, so every site benefits from what the others have seen. **This plugin requires the Hikosachi service.** It does not connect to the service until you either enter an API key or choose the free public blocklist on the settings page. See “External services” below for exactly what is sent. #### Features * **IP blocking** – Requests from IP addresses on the Hikosachi blocklist receive a 403 response. The list is updated every hour. * **Login protection** – Failed logins and failed Application Password authentications are detected and, with an API key, reported to the network. * **XML-RPC blocking** – Requests to xmlrpc.php, a common target of password guessing, are refused. * **Upload attack detection** – Attempts by visitors (or low-privilege users) to upload PHP files, requests for PHP files under wp-content/uploads, and path traversal patterns are refused. * **Vulnerability alerts** (optional, API key required) – Your installed plugin and theme versions are checked against a vulnerability database, and you are notified by email if your site is affected. * **Dashboard and login only from Japan** (optional, Professional plan or higher)– Refuses access to wp-admin and wp-login.php from IP addresses outside Japan, with an allowlist for your own addresses. * **WP-Cron diagnosis** – If scheduled updates stop running, the settings page explains the likely cause (Basic authentication, DISABLE_WP_CRON, WAF, redirects), and the blocklist keeps updating as a backup when the site has visitors. * **Site badge** (optional, off by default) – A small “Protected by Hikosachi” badge you can choose to show. #### Free and paid use * **Free public blocklist** – No account needed. Check “Use the free public blocklist” on the settings page. * **API key** – With a Hikosachi account, the site receives the full blocklist and reports the attacks it detects, which improves the list for everyone. Vulnerability alerts and the Japan-only restriction are provided by the service on the plans listed at [hikosachi.com](https://hikosachi.com/). All code in this plugin is included and active. Paid plans change what the Hikosachi service provides, not what the plugin can do. ### External services This plugin connects to the Hikosachi service (https://hikosachi.com/), operated by inexio LLC (アイネクシオ合同会社), Japan. Nothing is sent to the service until you enter an API key or enable the free public blocklist on **Settings > Hikosachi**. * Terms of service: https://hikosachi.com/terms.php * Privacy policy: https://hikosachi.com/privacy.php #### 1. Blocklist download * **Endpoint:** https://hikosachi.com/api/feed.php * **When:** Right after you save the settings, every hour via WP-Cron, when you press “Update the blocklist now”, and as a backup at the end of a page view if the last download was more than 2 hours ago. * **Data sent:** Your API key (if entered) and a User-Agent header containing the plugin version and your site URL (home_url). The site URL is used to count the number of sites on your plan. #### 2. Attack reports (API key only) * **Endpoint:** https://hikosachi.com/api/report.php * **When:** When the plugin detects a failed login, a failed Application Password authentication, a request to xmlrpc.php, an upload attack pattern, or an access from a blocked IP address. * **Data sent:** Your API key, the IP address of the request, the attack type, the requested URL (including its query string), and the User-Agent of the request. Reported IP addresses are evaluated and may be added to the blocklist shared with other users. Usernames, passwords, and information about members or customers are not sent. #### 3. Vulnerability alerts (API key only, off by default) * **Endpoint:** https://hikosachi.com/api/inventory.php * **When:** Once a day and about one minute after plugins or themes are installed, updated, activated, deactivated, or deleted – only after you enable “Vulnerability alerts”. * **Data sent:** Your API key, the site URL, the WordPress, PHP, and plugin versions, and the slug, version, and active state of every installed plugin and theme. #### 4. IP ranges for Japan (API key only, off by default) * **Endpoint:** https://hikosachi.com/api/country-ranges.php * **When:** When you enable “Allow the dashboard and login only from Japan” and then once a day, only while that option is enabled. * **Data sent:** Your API key and a User-Agent header containing the plugin version and your site URL. The ranges are derived from the public allocation records of APNIC. #### Connections to your own site When the settings page shows that WP-Cron is not running, the plugin sends one request from your server to your own wp-cron.php to find out why. The request has a dummy POST body, which makes WordPress exit before running any tasks, and only the HTTP status code is used. No data leaves your site. ## Installation 1. Install and activate the plugin from **Plugins > Add New**. 2. Open **Settings > Hikosachi**. 3. Enter your API key from the [Hikosachi member page](https://hikosachi.com/my/), or check **Use the free public blocklist**. 4. Save. The first blocklist is downloaded right away and then updated every hour. ## FAQ ### Does the plugin work without an account? Yes. Check “Use the free public blocklist” on the settings page. Attack reports, vulnerability alerts, and the Japan-only restriction require an API key. ### I use Jetpack or a mobile app that needs XML-RPC. This plugin refuses all requests to xmlrpc.php. If you rely on XML-RPC, this plugin is not a good fit for your site. ### My site is behind Cloudflare or a reverse proxy. The CF-Connecting-IP header is used only when the request actually comes from a Cloudflare edge server or a private/loopback address. If you use another reverse proxy that sets X-Forwarded-For, add `define( 'HIKOSACHI_TRUST_XFF', true );` to wp-config.php. Do not add it otherwise, because the header can be forged. ### I locked myself out with the Japan-only restriction. Add `define( 'HIKOSACHI_DISABLE_COUNTRY_LIMIT', true );` to wp-config.php. The restriction stops immediately. The plugin also refuses to enable the restriction if your current IP address would be blocked. ### Are logged-in editors blocked? Requests to the REST API, admin-ajax.php, and admin-post.php from users who can edit posts are not blocked, so automatic saving and integrations keep working. Low- privilege accounts (such as subscribers) are not exempt. ### What happens when I delete the plugin? All settings, the cached blocklist, and scheduled tasks are removed. Deactivating keeps your settings. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Hikosachi Protector” is open source software. The following people have contributed to this plugin. Contributors * [ TAKAHIRO ](https://profiles.wordpress.org/grooveline/) [Translate “Hikosachi Protector” into your language.](https://translate.wordpress.org/projects/wp-plugins/hikosachi-protector) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/hikosachi-protector/), check out the [SVN repository](https://plugins.svn.wordpress.org/hikosachi-protector/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hikosachi-protector/) by [RSS](https://plugins.trac.wordpress.org/log/hikosachi-protector/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 3.6.1 * The Japanese translation is bundled so that Japanese sites keep a Japanese interface until the language pack is available. #### 3.6.0 * Prepared for the WordPress.org plugin directory. * Nothing is sent to hikosachi.com until an API key is entered or the free public blocklist is enabled. Sites that already downloaded the free list with an earlier version keep using it. * The site badge is now off by default and shown only if you enable it. * Updates are now delivered from WordPress.org. * The interface is now translatable (English base, Japanese translation available). * Added uninstall cleanup and a Settings link on the Plugins screen. #### 3.5.2 * The settings page explains why WP-Cron is not running and shows times with the site time zone. #### 3.5.1 * Backup blocklist update when WP-Cron is not running. The reason for a failed download and the current plan are shown. #### 3.5.0 * Optional restriction of the dashboard and login page to Japan (Professional plan or higher). #### 3.4.0 * Optional vulnerability alerts for installed plugins and themes. ## Meta * Version **3.6.1** * Last updated **2 days ago** * Active installations **10+** * WordPress version ** 5.6 or higher ** * Tested up to **7.1.4** * PHP version ** 7.0 or higher ** * Tags * [Brute Force](https://wordpress.org/plugins/tags/brute-force/)[firewall](https://wordpress.org/plugins/tags/firewall/) [IP-blocking](https://wordpress.org/plugins/tags/ip-blocking/)[security](https://wordpress.org/plugins/tags/security/) [threat intelligence](https://wordpress.org/plugins/tags/threat-intelligence/) * [Advanced View](https://wordpress.org/plugins/hikosachi-protector/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/hikosachi-protector/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/hikosachi-protector/reviews/) ## Contributors * [ TAKAHIRO ](https://profiles.wordpress.org/grooveline/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/hikosachi-protector/)