IniLerm

Hi @cousineddie,

Thank you so much for taking the time to write this fantastic review!

Hearing that you find the balance between comprehensive security and simplicity to be spot-on is the best compliment a developer can receive. We worked hard to make those “one-click” options and the Security Scanner powerful yet easy to navigate, so your feedback confirms we are on the right track.

It is a pleasure to help protect your website. If you ever have suggestions to make it even better, we are listening!

Best regards,

Security > Settings > Login Protection

We’re taking this opportunity to inform you that we’ve included several improvements in version 8.6.8. We recommend enabling AIB Network in Settings and updating the ASN Whitelist to protect essential services (one per line) if you use them on your site. This will protect your site from false positives and keep essential services active.

https://advaipbl.com/aib-community-defense-network/

https://advaipbl.com/asn-blocking-guide/

This configuration ensures maximum compatibility with essential services while minimizing security risks.

Update release Version 8.6.8

• This reply was modified 8 months, 3 weeks ago by IniLerm.

# === Vulnerability Scanners & Pentesting Tools ===
Acunetix
Arachni
Burp
Dirb
DirBuster
Feroxbuster
Go-http-client
Havij
Nessus
Nikto
Nmap
Netsparker
OpenVAS
Photon/1.0
sqlmap
Vega
Wfuzz
WhatWeb
WPScan
WPSec
ZAP/
masscan
ScanNG
PressVuln
PostmanRuntime
CensysInspect
Expanse
internet-measurement
JSScanner/
paloaltonetworks
# === Generic Bots & Scripting Libraries ===
curl
HTTrack
Java/
okhttp
perl
php/
Python
python-requests
Scrapy
wget
libwww
ruby
# === Aggressive Scrapers & Black Hat SEO Bots ===
#AhrefsBot
Bytespider
contabot
dataprovider
DigExt
DotBot
EmailCollector
ExtractorPro
MegaIndex
#MJ12bot
SemrushBot
WebCollector
WebCopier
AliyunSecBot
AwarioBot
BW/
#GoogleOther
IonCrawl
ISSCyberRiskCrawler
# === Spam, Low-Quality AI & Comment Bots ===
Applebot-Extended
ClaudeBot
Diffbot
FacebookBot
FriendlyCrawler
#Google-Extended
ImagesiftBot
Image2dataset
#Meta-ExternalAgent
omgili
Timpibot
omgilibot
AcoonBot/
anthropic-ai
BoardReader
CCBot
ChatGPT-User
Claude-Web
DataForSeoBot
GPTBot
PerplexityBot
petalbot
#YandexBot
ZmEu
# === Aggressive Regional Crawlers (optional) ===
Baiduspider
Baiduspider-image
Baiduspider-news
Barkrowler
msnbot-media
SeznamBot
Sogou
YisouSpider
BLEXBot
news-please
Orbbot
peer39_crawler
VelenPublicWebCrawler
#wp_is_mobile
Zoominfobot
# === Suspicious or Malformed User-Agents ===
Dalvik/
morfeus
ShellBot
zgrab
Chrome/45
Mozilla/4.0
Empty
Mozlila
GRequests/

Common User-Agent Suggestions to Block
You can copy and paste in Blocking Rules > User Agents > Blocked User-Agents List

More info https://advaipbl.com/bots-you-should-block-to-protect-your-content/

Hi @wordlion,

Thank you for your feedback! You make a very valid point about UX design: red indicators usually signal that an action is required, whereas in our case, it’s just a status report (“Threats blocked”).

We appreciate the suggestion and will definitely consider adding an option to toggle these badges in a future update (likely v8.7).

Immediate Solution:
In the meantime, you can regain control of your workspace by adding this small snippet to your theme’s functions.php file (or using a Code Snippets plugin). It simply hides the red notification bubbles for this plugin:codePHP

add_action('admin_head', 'advaipbl_hide_menu_badges');

function advaipbl_hide_menu_badges() {
    echo '<style>
    #toplevel_page_advaipbl_settings_page .awaiting-mod,
    #toplevel_page_advaipbl_settings_page .update-plugins {
        display: none !important;
    }
    </style>';
}

This will instantly remove the “noise” while keeping the protection active in the background.

Thanks for helping us improve the interface!

Best regards,

Hi @fredpeng,
Thank you for confirming. This clarifies the issue completely.
The problem is that your theme or WooCommerce template uses a custom login form that does not trigger the standard WordPress hooks (login_form). Because of this, our plugin cannot inject the reCAPTCHA code into those specific “My Account” forms.
Since we cannot modify your theme’s code, my recommendation is to disable reCAPTCHA to ensure your customers can log in smoothly, and instead rely on the other powerful layers of protection included in Advanced IP Blocker.
Recommended Security Setup for WooCommerce:
Even without reCAPTCHA, you can achieve enterprise-grade security by enabling these features:
AIB Community Defense Network (New in v8.6.2):
Where: Security > Settings > Threat Intelligence
Why: This blocks thousands of verified malicious IPs (many of which target login pages) before they even load your site. It is a shared global firewall.
AbuseIPDB Protection:
Where: Security > Settings > Threat Intelligence
Why: Create a free account for each site. This checks every visitor against a global database of hackers. It is extremely effective at stopping brute-force botnets.
Failed Login Blocking:
Where: Security > Settings > Threshold Blocking
Why: Set this to block an IP after 5 failed attempts. This stops brute-force attacks cold.
Login Page Lockdown Mode:
Where: Security > Settings > Login & User Protection
Why: If your site comes under heavy attack, this will automatically present a JavaScript challenge to visitors, filtering out bots without bothering humans.
Critical Hardening (Enable These):
Prevent Login Hinting: Stops hackers from knowing if a username exists.
REST API User Protection: Prevents bots from scraping your user list.
(Note: Do NOT enable “Whitelist Login Access” on a WooCommerce site, or you will block your customers).
2FA for Administrators (Highly Recommended):
If your server runs PHP 8.1+, enable Two-Factor Authentication and enforce it for Administrator roles. This makes your admin accounts virtually impossible to hack, even if they guess the password.
Final Tip:
Ensure your own IP and your server’s IP are in the Whitelist (Security > Dashboard > System Status) to prevent accidental lockouts while configuring these settings.
I hope this helps you secure your shops effectively! I will mark this topic as resolved, but feel free to open a new one if you have other questions.
Best regards,

• This reply was modified 9 months, 1 week ago by IniLerm.

Hi Fredpeng,
This is great progress! Seeing “Protected” in the Google Console means the connection is working.
The error Please complete the reCAPTCHA verification specifically means that when the login form reaches the server, the hidden “recaptcha token” field is empty.
Since the keys are correct, this is likely a Front-end / JavaScript issue:
Are you using a custom login form?
Are you logging in via the standard /wp-login.php page, or are you using a custom login widget (e.g., a popup, sidebar widget, or WooCommerce “My Account” page)?
Why this matters: The plugin automatically adds the necessary hidden field to the standard WordPress login form. Some custom theme forms do not use the standard hooks, so the field might be missing or the JavaScript cannot find where to put the token.
JavaScript Console Check:
If possible, could you open your browser’s Developer Tools (F12) on the login page, go to the Console tab, and check if there are any red JavaScript errors? (e.g., “Cannot set property of null” or “grecaptcha is not defined”).
A quick test:
Please try logging in directly via yourdomain.com/wp-login.php (the default WP login page) instead of any custom login page provided by your theme. Does it work there?
Best regards,