WP-Ban 2.0.0

WP-Ban 2.0.0 is a total rewrite of the plugin with Claude Code to make it more modern and testable. There will be breaking changes. Please do test it https://github.com/lesterchan/wp-ban/archive/refs/heads/master.zip

WP-Ban 2.0.0 requires WordPress 6.8 and PHP 8.2. A site on an older stack is simply not offered the update, so if WP-Ban has stopped appearing in your updates list, that is why.

The screen is three tabs now. Settings -> Ban used to be one page carrying the proxy options, six ban lists, the banned message and the stats table end to end. It opens on Stats, with the lists under Settings and the message under Templates. Nothing moved in the database — all three tabs write the same wp_ban_options row — so a bookmark or a screenshot pointing at the old page still lands on the screen, just on the first tab. Add &tab=settings or &tab=templates to go straight to one.

Proxy headers are no longer trusted unless you say so. Until 2.0.0 the plugin read HTTP_X_FORWARDED_FOR and friends whenever the reverse proxy box was ticked, and those headers are set by the visitor — so on a site with no proxy in front of it, anyone could walk past an IP ban by sending a different value on each request. If your site is behind a proxy, open Settings -> Ban, go to the Settings tab, and name the exact header your proxy sets in the new Header That Contains The IP field. Otherwise do nothing.

The This site is behind a reverse proxy checkbox is gone, and if you had it ticked, read this one. The box trusted whichever of seven forwarding headers turned up on a request, which is the insecure half of the two settings — a visitor can send any of the seven. The field beside it does the same job properly by naming the single header your own proxy sets and overwrites, so that is all there is now. If you had the box ticked and had not named a header, the update names HTTP_X_FORWARDED_FOR for you. That is the header essentially every proxy and CDN sets, Cloudflare included, so for almost every site it is simply correct and there is nothing to do. If your proxy sets only something more unusual — HTTP_CLIENT_IP, say — you must now type that name into the field yourself: open Settings -> Ban, go to the Settings tab, and check that Your IP at the top of that section shows your own address and not your proxy’s. If it shows the same address for everybody, the header named in the field is not the one your stack sets. Your host or your CDN’s documentation will tell you which it is. Nothing changes for a site that already named a header, or for one that never ticked the box.

Banned visitors get a 403, not a 200. Uptime monitors and SEO tools that were treating the ban page as real content will start reporting 403 for banned addresses. Filter wp_ban_status_code to return 200 for the old behaviour.

Settings migrate on the first admin page load, and the old rows are deleted. banned_options, banned_ips, banned_ips_range, banned_hosts, banned_referers, banned_user_agents, banned_exclude_ips and banned_message become one wp_ban_options row; banned_stats becomes wp_ban_stats; ban_db_version becomes wp_ban_version. Point any backup script, migration tool or wp-config.php snippet naming an old row at the new one.

Every global function the plugin declared is gone. banned(), ban_get_ip(), print_banned_message(), process_ban(), is_admin_ip() and preg_match_wildcard() were unprefixed, declared on every request and never a documented API; calling one now fatals. The replacements are static methods on WP_Ban_IP and WP_Ban_Options, plus six filters and one action: wp_ban_capability, wp_ban_denied, wp_ban_enabled, wp_ban_ipaddress, wp_ban_protect_self, wp_ban_status_code and wp_ban_trust_proxy.

Two fixes applied to stored entries on the way through. Entries were stored HTML-escaped, so a referrer pattern containing & could never match a real Referer header, and re-saving compounded it. And a malformed IP range — anything that was not two valid addresses of the same type — matched every visitor at or below its upper bound, banning the whole audience. Malformed ranges no longer match anybody, and are dropped at the first save.

The page I need help with: [log in to see the link]