Adds local protection for page-template traversal. Update WordPress core to 7.1.2 or the patched release for your branch as well.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3706552,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3706552,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3706552,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3706552,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3706552,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.6.46","0.6.47"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[131228,2439,1174,600,599],"plugin_category":[54],"plugin_contributors":[281942],"plugin_business_model":[],"class_list":["post-365458","plugin","type-plugin","status-publish","hentry","plugin_tags-blocklist","plugin_tags-brute-force","plugin_tags-firewall","plugin_tags-security","plugin_tags-spam","plugin_category-security-and-spam-protection","plugin_contributors-witenlabs","plugin_committers-witenlabs"],"banners":{"banner":"https:\/\/ps.w.org\/witen-blocker\/assets\/banner-772x250.png?rev=3706552","banner_2x":"https:\/\/ps.w.org\/witen-blocker\/assets\/banner-1544x500.png?rev=3706552","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/witen-blocker\/assets\/icon.svg?rev=3706552","icon":"https:\/\/ps.w.org\/witen-blocker\/assets\/icon.svg?rev=3706552","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"\n
Witen Blocker helps protect your WordPress site from password guessing, unwanted bots, and comment spam. Add two-factor authentication, check suspicious file changes, and review detections and blocks in your WordPress dashboard.<\/p>\n\n
Start with free local protection. Connect to Witen when you want blocklists informed by attacks seen across participating sites and servers.<\/p>\n\n
Limit repeated failed login attempts and add two-factor authentication with an authenticator app. Recovery codes give you a way back in if you lose your device.<\/p>\n\n
Choose which recognized search crawlers, AI crawlers, and automated clients to allow or block. Manage trusted addresses and review detections before blocking.<\/p>\n\n
Catch automated submissions with hidden form fields and timing checks. These checks run on your site without sending comment text to a spam service.<\/p>\n\n
Compare WordPress core files with official checksums, monitor changes in your content directory, and scan files for suspicious patterns. Bundled checks work without an account. Connected sites can receive maintained malware catalogs. Review findings before taking action.<\/p>\n\n
The optional Witen service combines security reports from participating sites and servers to identify repeat attackers and maintain shared blocklists. An enrolled site can block listed IPs even if they haven't attacked that site before. Reports are processed centrally; request checks use a local blocklist.<\/p>\n\n
Enrollment requires a Witen account and security-event sharing. All local features are free, with no trial expiry. Hosted plans determine feeds, update frequency, and off-site backup storage.<\/p>\n\n
On shared hosting, matching blocklist requests receive an HTTP 403 response from WordPress. No server administration access is needed. On your own server, the optional Witen Warden agent can enforce IP blocks at the firewall, before blocked traffic reaches PHP.<\/p>\n\n
Get started:<\/strong> install Witen Blocker and open Witen > Settings<\/strong>. Local protection needs no account.<\/p>\n\n Setup guide<\/a> | Witen plans<\/a> | Support<\/a><\/p>\n\n Connected features use Background sync sends events and site details (listed below) and retrieves blocklists, bot identities, signed malware catalogs, Tor exit nodes, allowlists, service status, network statistics, and feed profiles. Profile changes send your selection and site identifier; IP lookups send the queried address. Block reports include the IP, rule, outcome, request context, and site identifier.<\/p>\n\n Witen terms<\/a> | Witen privacy policy<\/a><\/p>\n\n Enrolled sites refresh Cloudflare terms<\/a> | Cloudflare privacy policy<\/a><\/p>\n\n Integrity scans request official hashes from WordPress.org privacy policy<\/a><\/p>\n\n The plugin does not remotely load executable code or frontend assets. Bundled bot references cause no remote requests or crawler DNS lookups. Collector connections use your DNS resolver. Background jobs and Apache rule checks call your own WordPress URLs.<\/p>\n\n Events stay local until enrollment or explicit Warden socket configuration. Earlier events are never uploaded retroactively. Connected intelligence requires event sharing; use offline mode or deactivate to stop it.<\/p>\n\n What is shared:<\/strong> IP addresses; successful and failed logins; XML-RPC, comment, registration, and 404 events; request URLs, methods, User-Agent strings, referrers, and query information; and attempted usernames, which may be email addresses. Installation reports include site name and URL, WordPress\/PHP\/plugin versions, and a random installation identifier. An observed IP is not necessarily an attacker. Reports help identify distributed attacks, relate failed logins to later successful ones, and maintain blocklists.<\/p>\n\n Event reports exclude form bodies, post content, comment text, password fields, cookies, and session data. URLs and metadata can contain personal data. File samples and .htaccess backups are separate options, described above. Local storage:<\/strong> the delivery queue holds up to 500 events for seven days. Witen also keeps the latest 100 dashboard events and blocks, block and allow lists, and health counters. Rejected events and block-decision reports have separate diagnostic queues, each limited to 100 records or 1 MiB. Older records are removed at the limit; diagnostics otherwise remain until uninstall.<\/p>\n\n Deactivation preserves settings. Uninstall removes Witen options, transients, scheduled actions, and database tables. Collector retention follows its operator's privacy policy; request collector-side deletion from that operator.<\/p>\n\n\nExternal Services<\/h3>\n\n
Witen Collector<\/h4>\n\n
https:\/\/collector.witenlabs.com<\/code>. Enrollment exchanges your setup token and installation identity for a credential. Witen processes shared reports to identify distributed attacks and provide threat intelligence.<\/p>\n\n\n
WITEN_SEND_MALWARE_SAMPLES<\/code> to boolean true<\/code> in wp-config.php<\/code> permits file-content uploads. Scans do not require them.<\/li>\nWITEN_COLLECTOR_URL selects another collector if you operate one; its operator's policies apply. Explicitly configuring `WITEN_SOCKET_PATH` authorizes sharing with local Warden, whose configuration controls onward delivery. Detecting a socket alone does not enable sharing.\n<\/code><\/pre>\n\nCloudflare proxy ranges<\/h4>\n\n
https:\/\/www.cloudflare.com\/ips-v4\/<\/code> and https:\/\/www.cloudflare.com\/ips-v6\/<\/code> during background maintenance to recognize trusted proxies. Offline sites use bundled ranges. Requests send ordinary HTTPS network metadata, not WordPress visitor events or account data.<\/p>\n\nWordPress.org core checksums<\/h4>\n\n
https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/code>, sending your WordPress version, locale, and ordinary HTTPS network metadata. No visitor events, account data, or site content is sent.<\/p>\n\nPrivacy Policy<\/h3>\n\n
WITEN_NO_TELEMETRY<\/code> stops daily installation reports, but not connected security-event sharing.<\/p>\n\n\n