{"id":352450,"date":"2026-08-19T16:20:56","date_gmt":"2026-08-19T16:20:56","guid":{"rendered":"https:\/\/it.wordpress.org\/plugins\/cisilino-site-defense-network\/"},"modified":"2026-08-19T16:25:04","modified_gmt":"2026-08-19T16:25:04","slug":"cisilino-site-defense-network","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/cisilino-site-defense-network\/","author":368693,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.1","stable_tag":"1.0.1","tested":"7.0.4","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"Cisilino Site Defense Network","header_author":"Matteo Cisilino","header_description":"Rileva i tentativi di login WordPress falliti, blocca localmente gli IP molesti in .htaccess e scambia un digest di IP con il pannello Cisilino (sezione Firewall\/LOGs) e con gli altri siti della rete.","assets_banners_color":"","last_updated":"2026-08-19 16:25:04","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/cisilino.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":53,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"matteo.cisilino","date":"2026-08-19 16:14:15"},"1.0.1":{"tag":"1.0.1","author":"matteo.cisilino","date":"2026-08-19 16:25:04"}},"upgrade_notice":{"1.0.0":"<p>Prima versione pubblicata su wordpress.org.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Settings page: unified blacklist, with an \"Unblock\" button on each row.","2":"Optional hardening section (all toggles disabled by default).","3":"Activity log of the last 50 detections."}},"plugin_section":[],"plugin_tags":[2439,1174,1329,602,600],"plugin_category":[38,54],"plugin_contributors":[276535],"plugin_business_model":[],"class_list":["post-352450","plugin","type-plugin","status-publish","hentry","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-htaccess","plugin_tags-login","plugin_tags-security","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-matteocisilino","plugin_committers-matteocisilino"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/cisilino-site-defense-network.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Cisilino Site Defense Network watches failed login attempts on your\nWordPress site. Once an IP exceeds a configurable threshold, it gets\nblocked locally by adding a rule to the site's <code>.htaccess<\/code> file\n(compatible with both Apache 2.4 and 2.2).<\/p>\n\n<p><strong>Blacklist and log<\/strong><\/p>\n\n<p>A single page (Settings &gt; Cisilino Site Defense Network) shows:<\/p>\n\n<ul>\n<li>a unified blacklist (IPs blocked locally, received from the network, or\nadded manually), with an \"Unblock\" button on each row;<\/li>\n<li>a log of the last 50 detections;<\/li>\n<li>a manual ban\/unban override for a specific IP, with an optional\nexpiry (permanent, 1 hour, 6 hours, 24 hours or 7 days);<\/li>\n<li>a whitelist of trusted IPs (e.g. your office network): unlike an\nunban, a whitelisted IP is not even counted as a failed attempt.<\/li>\n<\/ul>\n\n<p><strong>Activity log (local, with its own retention)<\/strong><\/p>\n\n<p>A dedicated tab (\"Registro attivita\") records what happens on the site:\nlogins and logouts, failed login attempts, user creation\/deletion\/role\nchanges, content published or deleted, comments, media, plugin and theme\nactivation\/update, WordPress core updates, changes to significant core\nsettings, menus, widgets, theme\/plugin file edits from wp-admin, and\ncontent exports. Each group can be turned on or off individually.<\/p>\n\n<p>Plugin settings changes are recorded too, with a before\/after of the\nfields that actually changed: this plugin's own settings in full detail\n(panel connection, whitelist, hardening, IP overrides, activity log\noptions), and other plugins' settings when they are declared through the\nWordPress Settings API. Values of options whose name suggests a secret\n(key, token, password, licence...) are never recorded - only the fact\nthat they changed.<\/p>\n\n<p>Emptying the local log, deactivating and uninstalling the plugin are\nthemselves recorded as events. Emptying the local log never sends any\ndeletion command to the panel: the history already delivered there stays\nuntouched.<\/p>\n\n<p>Deactivating or uninstalling the plugin is itself recorded, and the plugin\ntries to deliver that final entry to the panel before removing anything \u2014\nso the panel can tell \"the plugin was removed on purpose\" apart from \"the\nsite went silent\".<\/p>\n\n<p>Each entry is written <strong>locally first<\/strong>, in its own table, and then\ndelivered to the panel immediately - at the end of the request in which\nit happened, never inside the action itself, so a visitor never waits\nfor the panel. If the panel is unreachable the entry simply stays queued\nand is retried: delivery is delayed, entries are not lost. The daily\nretention cleanup only removes entries the panel has already confirmed,\nso a long panel outage can never make undelivered events disappear.<\/p>\n\n<p>The retention on the panel side is a separate setting, managed by the\ncustomer in the panel: shortening the local retention does not shorten\nthe panel's history, and vice versa.<\/p>\n\n<p><strong>Integrity self-check<\/strong><\/p>\n\n<p>The plugin verifies the MD5 hashes of its own files against a manifest\nshipped with the release (or, if that is absent, a snapshot taken at\nactivation), once a day and on demand. Modified, missing and unexpected\nfiles are all reported - a web shell dropped into a plugin folder is one\nof the most common ways an infection hides. The result is also sent to\nthe panel, because a copy of that information outside the machine is the\none an attacker on that machine cannot edit.<\/p>\n\n<p>Known limit, stated plainly: whoever can already write to the files can\nalso rewrite the manifest or disable the check. This detects tampering,\nit does not prevent it.<\/p>\n\n<p><strong>File upload monitoring<\/strong><\/p>\n\n<p>Uploads are recorded even when they do not go through the media library\n- plugin forms, admin-ajax endpoints, arbitrary theme uploads - which is\nwhere most web shells actually get in. Executable extensions are\nflagged, including double extensions such as \"harmless.php.jpg\", and can\noptionally be rejected outright (off by default, since it can break\nplugins that legitimately upload archives).<\/p>\n\n<p><strong>Optional hardening<\/strong><\/p>\n\n<p>A dedicated section (everything disabled by default, must be turned on\nmanually) lets you:<\/p>\n\n<ul>\n<li>block PHP execution inside <code>wp-content\/uploads<\/code>;<\/li>\n<li>disable directory listing where no <code>index<\/code> file exists;<\/li>\n<li>block direct access to <code>wp-config.php<\/code>, <code>.htaccess<\/code>, <code>readme.html<\/code>,\n  debug.log;<\/li>\n<li>block custom paths;<\/li>\n<li>disable XML-RPC;<\/li>\n<li>block user enumeration via <code>?author=N<\/code>.<\/li>\n<\/ul>\n\n<p><strong>Cisilino network (optional)<\/strong><\/p>\n\n<p>If you configure the URL of a Cisilino Site Defense Network panel with a\ncustomer code and API key (plugin Settings), the site periodically\n(every 15 minutes) sends a digest of observed IPs and receives back the\nIPs already banned for your customer by other sites in the network \u2014 so\na hostile IP detected elsewhere gets blocked here too, without waiting\nfor it to hit this site as well. See \"== External services ==\" below for\ndetails on what is sent.<\/p>\n\n<p><strong>With no configuration at all, the plugin still protects the site on\nits own<\/strong>, locally only, with no outbound calls whatsoever.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin can connect, only if you explicitly configure it (Settings &gt;\nCisilino Site Defense Network &gt; Panel URL, customer code, API key), to a\n\"Cisilino Site Defense Network\" panel \u2014 a server that you or your\nprovider manage, not a third-party service imposed by the plugin. <strong>If\nyou leave these fields empty, the plugin makes no external calls at\nall<\/strong>: it works locally only.<\/p>\n\n<p>Once configured, the plugin contacts the panel for one purpose:<\/p>\n\n<ul>\n<li><strong>IP digest exchange<\/strong> (every 15 minutes, or on the panel's manual poll\nrequest): sends your customer code, the site URL, and a digest of\nfailed login attempts observed since the last send (remote IP,\nattempted username, outcome, date\/time \u2014 never the password). Receives\nback the list of IPs already banned for your customer. Endpoint:\n  {panel URL}\/api\/ip-exchange\/sync.<\/li>\n<li><strong>Activity digest<\/strong> (same request, same endpoint, only if the activity\nlog and its \"send to panel\" option are both enabled): the activity\nentries not yet sent - date\/time, WordPress user and role, IP, event\ngroup and action, name of the object involved, and a short summary.\nNever any password, and never the content of a post, comment or file.<\/li>\n<\/ul>\n\n<p>The reference panel is a Cisilino product\n(<a href=\"https:\/\/cisilino.com\/\">https:\/\/cisilino.com\/<\/a>). Since the URL is\nconfigurable, a user could in theory point it at their own compatible\npanel: in that case this disclosure applies to that panel, not to\nCisilino.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin from Plugins &gt; Installed Plugins.<\/li>\n<li>(Optional) Go to Settings &gt; Cisilino Site Defense Network and paste\nthe panel URL, customer code and API key generated by the panel, to\nenable digest exchange with the network.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20to%20configure%20anything%20to%20use%20the%20plugin%3F\"><h3>Do I need to configure anything to use the plugin?<\/h3><\/dt>\n<dd><p>No. As soon as it's activated, it already detects failed login attempts\nand blocks IPs that exceed the threshold in <code>.htaccess<\/code>, with no\nconfiguration needed.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20i%20don%27t%20configure%20the%20panel%20connection%3F\"><h3>What happens if I don't configure the panel connection?<\/h3><\/dt>\n<dd><p>The plugin keeps working normally, locally only: it detects and blocks\non its own, without exchanging or sending anything externally.<\/p><\/dd>\n<dt id=\"where%20do%20i%20find%20the%20customer%20code%20and%20api%20key%3F\"><h3>Where do I find the customer code and API key?<\/h3><\/dt>\n<dd><p>They are generated by the Cisilino Site Defense Network panel your site\nis associated with, in the section dedicated to this plugin's API keys.<\/p><\/dd>\n<dt id=\"is%20the%20collected%20data%20shared%20with%20third%20parties%3F\"><h3>Is the collected data shared with third parties?<\/h3><\/dt>\n<dd><p>Only if you explicitly configure a panel: in that case the attempted IPs\nand usernames (never passwords) are sent to the panel you configured\nyourself. See the \"External services\" section for full details.<\/p><\/dd>\n<dt id=\"does%20it%20work%20on%20non-apache%20hosting%20%28e.g.%20nginx%29%3F\"><h3>Does it work on non-Apache hosting (e.g. nginx)?<\/h3><\/dt>\n<dd><p>IP blocking writes rules into <code>.htaccess<\/code>, so it requires Apache (or\nLiteSpeed in compatible mode). Detection and panel-side management\nremain available regardless; only the actual server-level block requires\nApache.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20i%20deactivate%20the%20plugin%3F\"><h3>What happens if I deactivate the plugin?<\/h3><\/dt>\n<dd><p>All rules written to <code>.htaccess<\/code> (IP blocking, hardening) are removed: a\ndeactivated plugin must not keep enforcing rules you can no longer see\nor manage. Reactivating it restores everything exactly as it was: no\ndata is lost on deactivation.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Ripulitura del readme: il changelog riporta solo le versioni pubblicate sul repository ufficiale.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Prima versione pubblica.<\/li>\n<li>Difesa dei login: rilevamento dei tentativi falliti, blocco locale degli IP\nmolesti in .htaccess, whitelist e sblocco manuale dalla pagina impostazioni.<\/li>\n<li>Rete Cisilino: scambio facoltativo di un digest di IP ostili con il pannello\ne con gli altri siti della rete, disattivato finch\u00e9 non si configura il\ncollegamento.<\/li>\n<li>Registro attivit\u00e0: gli eventi rilevanti del sito (accessi, utenti,\ncontenuti, plugin, temi, core, opzioni, media, caricamenti) sono registrati\nlocalmente con una retention configurabile, e inviati al pannello subito\ndopo l'evento senza rallentare la pagina servita.<\/li>\n<li>Verifica di integrit\u00e0: il plugin confronta gli hash MD5 dei propri file con\nil manifesto distribuito nella release e segnala file modificati, mancanti o\nnon previsti nella propria cartella.<\/li>\n<li>Sorveglianza dei caricamenti: registra i file che entrano nel sito anche\nfuori dalla libreria media, riconosce le estensioni eseguibili comprese le\ndoppie estensioni tipo immagine.php.jpg, e pu\u00f2 rifiutarle.<\/li>\n<li>Irrigidimenti facoltativi, tutti disattivati per impostazione predefinita.<\/li>\n<\/ul>","raw_excerpt":"Blocks login brute-force attempts in .htaccess, optionally exchanges hostile IPs with the Cisilino network, offers whitelisting and basic hardening.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/352450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=352450"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/matteocisilino"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=352450"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=352450"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=352450"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=352450"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=352450"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=352450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}