This is a maintenance release.
- Bug fix: Fix the issue that the login-fail-counter didn't work when the
Login form was
block by country (register, lost password).
In this release, the login-fail-counter works correctly.
- Bug fix: Fix the issue that the validation settings of
Admin area and
Admin ajax/post were influential with each other. Now each of those works
- Bug fix: "Site Stats" of Jetpack is now shown on the admin bar which
issue was reported on support forum.
- Improvement: Hide checking the existence of log db behind the symbol
IP_GEO_BLOCK_DEBUG to reduce 1 query on admin screen.
- Improvement: Add alternative functions of BCMath extension to avoid
PHP Fatal error: Call to undefined function in
IPv6 is specified.
- Improvement: Use MaxMind database at the activating process not to be
locked out by means of inconsistency of database at the activation and after.
- See more details at 2.1.1 release note
- New feature: Added
Block by country (register, lost password) at
Login form on
Settings tab in order to accept the registered users as
membership from anywhere but block the request of new user ragistration and
lost password by the country code. Is't suitable for BuddyPress and bbPress.
- Improvement: Added showing the custom error page for http response code
4xx and 5xx. For example the
403.php in the theme template directory or in
the child theme directory is used if it exists. And new filter hooks
ip-geo-block-(comment|xmlrpc|login|admin)-(status|reason) are available
to customize the response code and reason for human.
- Obsoleted: Obsoleted the filter hooks
ip-geo-block-(admin-actions|admin-pages|wp-content). Alternatively new
ip-geo-block-bypass-(admins|plugins|themes) are added to
- Find out more details in the 2.1.1 release note.
- New feature: Expanded the operating range of ZP-ZEP, that includes admin
area, plugins area, themes area. Now it can prevent a direct malicios attack
to the file in plugins and themes area. Please go to the "Validation Settings"
on "Settings" tab and check it. Also check my article in
"Analysis of Attack Vector against WP Plugins".
- Bug fix: Fixed the issue that action hook
not work correctly because the order of argument was mismatched.
- Bug fix: Fixed the issue that a record including utf8 4 bytes character
in its columns was not logged into DB in WordPress 4.2.
- Improvement: Fixed the issue that Referer Suppressor do nothing with a
new element which is added into DOM after DOM ready. The event handler is
now delegated at the
- Fixed an issue that a certain type of attack vector to the admin area (
) could not be blocked by the reason that some plugins accept it on earlier
init) than this plugin (previously
- Added re-creating DB table for validation logs in case of accidentally
failed at activation process.
- The time of day is shown with local time by adding GMT offset based on
the time zone setting.
- Optimized resource loading and settings to avoid redundancy.
- See details at this plugin's blog.
- Improved UI on admin screen.
- Added a diagnosis for creation of database table.
- Sorry for frequent update but added a function of showing admin notice
when none of the IP geolocation providers is selected. Because the user
will be locked out from admin screen when the cache expires.
- Bug fix: Fixed an issue of
get_geolocation() method at a time of
when the cache of IP address is cleared.
- Referer suppressor now supports meta referrer
- Bug fix: Fixed an issue that empty black list doesn't work correctly
when matching rule is black list.
- New feature: Added 'Zero-day Exploit Prevention for wp-admin'.
Because it is an experimental feature, please open a new issue at
if you have any troubles with it.
- New feature: Referer suppressor for external link. When you click an
external hyperlink on admin screen, http referer will be suppressed to
hide a footprint of your site.
- Also added the filter hook
ip-geo-block-admin-actions for safe actions
- New feature: Include
wp-admin/admin-post.php as a validation target
Admin area. This feature is to protect against a vulnerability
Analysis of the Fancybox-For-WordPress Vulnerability
on Sucuri Blog.
- Added a sample code snippet as a use case for 'Give ajax permission in
case of safe actions on front facing page'. See Example 10 in
- Fixed the issue of improper scheme from the HTTPS site when loading js
for google map.
- In order to prevent accidental disclosure of the length of password,
changed the length of
* (masked password) which is logged into the
- New feature: Protection against brute-force and reverse-brute-force
xmlrpc.php and admin area.
This is an experimental function and can be enabled on
Malicious access can try to login only 5 times per IP address. This retry
counter can be reset to zero by
Clear statistics on
- New feature: Added a new class for recording the validation logs to
analyze posting pattern.
- Fixed an issue of not being set the own country code at first installation.
- Fixed an error which occurs when ip address is unknown.
- New feature: Added validation of trackback spam.
$_SERVER keys for extra IPs into options to validate additional
- Removed some redundant codes and corrected all PHP notices and warnings
which had been suppressed by WordPress.
- New feature: Added validation of pingback.ping through
new option to validate all the IP addresses in HTTP_X_FORWARDED_FOR.
- Fixed an issue: Maxmind database file may be downloaded automatically
without deactivate/re-activate when upgrade is finished.
- This is the final version on 1.x. On next release, accesses to
and admin area will be also validated for security purpose.
- Fixed an issue: Option table will be updated automatically without
deactivate/re-activate when this plugin is upgraded.
- A little bit performance improvement:
Less memory footprint at the time of downloading Maxmind database file.
Less sql queries when
Save statistics is enabled.
- New feature: Added Maxmind GeoLite database auto downloader and updater.
- The filter hook
ip-geo-block-validate was discontinued.
Instead of it, the new filter hook
ip-geo-block-comment is introduced.
- Performance improvement: IP address is verified at an earlier stage
- Others: Fix a bug of handling cache, update status of some REST APIs.
- Fixed issue of default country code.
When activating this plugin for the first time, get the country code
from admin's IP address and set it into white list.
- Add number of calls in cache of IP address.
- Implement the cache mechanism to reduce load on the server.
- Better handling of errors on the search tab so as to facilitate the
analysis of the service problems.
- Fixed a bug of setting user agent strings in 1.0.2.
Now the user agent strings (
becomes to its own (
WordPress/3.9.2; ip-geo-block 1.1.0).
- Temporarily stop setting user agent strings to supress a bug in 1.0.2.
- Update provider settings. Smart-IP.net was terminated, ipinfo.io is now
available for IPv6.
- Set the own user agent strings for
- Modify Plugin URL.
apply_filters() to be able to change headers.