Protect your WordPress site by detecting, blocking and reporting malicious IPs using the AbuseIPDB API. Includes brute-force protection.

Marc Gran

GranTech IP Firewall for AbuseIPDB connects your WordPress installation to the community-driven <a href="https://www.abuseipdb.com/" rel="nofollow ugc">AbuseIPDB</a> database to automatically detect, block, and report abusive IP addresses before they can cause damage.
<h4>Key Features</h4>
<ul>
<li>Real-time IP checks — Queries the AbuseIPDB API on sensitive endpoints (login, XML-RPC, comments).</li>
<li>Automatic blocking — IPs exceeding the configured abuse score threshold are blocked instantly.</li>
<li>Brute-force protection — Detects brute-force attacks on wp-login.php and XML-RPC and blocks the offending IP after N failed attempts.</li>
<li>Automatic reporting — Reports aggressive IPs to AbuseIPDB (Brute-Force category) to contribute back to the community database.</li>
<li>Smart caching — Caches API responses to minimise daily quota consumption.</li>
<li>Whitelist support — Exempt individual IPs or CIDR ranges from checks.</li>
<li>Admin dashboard — 30-day statistics, activity chart, and top offending IPs at a glance.</li>
<li>Event log — Full history of all events, filterable by IP and event type.</li>
<li>Manual blocklist — Block and unblock IPs manually from the admin panel.</li>
<li>Automatic cleanup — Hourly cron job purges expired blocks and logs older than 90 days.</li>
<li>Cloudflare support — Automatically reads the CF-Connecting-IP header to get the real visitor IP.</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>When an IP accesses a sensitive endpoint (login, XML-RPC, comment submission), the plugin queries the AbuseIPDB API.</li>
<li>If the abuse confidence score meets or exceeds the configured threshold (default 50/100), the IP is blocked automatically.</li>
<li>If multiple failed login attempts are detected from the same IP, it is blocked and reported to AbuseIPDB as a brute-force attack.</li>
<li>All events are recorded in the admin dashboard.</li>
</ol>
<h4>API Requirements</h4>
A free account at <a href="https://www.abuseipdb.com/register" rel="nofollow ugc">abuseipdb.com</a> is required. 
The free plan includes 1,000 checks per day, which is sufficient for most sites when combined with the built-in caching system.
<h3>External Services</h3>
This plugin connects to the AbuseIPDB API (https://api.abuseipdb.com/api/v2/) to check and report IP addresses.
What is AbuseIPDB? 
AbuseIPDB is a community-driven project that maintains a database of IP addresses reported for abusive behavior (spam, hacking, brute-force attacks, etc.). This plugin uses their public API to protect your WordPress site.
What data is sent and when?
<ul>
<li>IP address check: When a visitor accesses a sensitive endpoint (wp-login.php, xmlrpc.php, comment submission), the visitor’s IP address is sent to AbuseIPDB to retrieve its abuse confidence score. This only happens when the endpoint is accessed — not on regular page visits.</li>
<li>IP address report: When a brute-force attack is detected (configurable number of failed login attempts), the offending IP address is reported to AbuseIPDB along with a description of the attack and your site’s URL. Reporting can be disabled in the plugin settings.</li>
</ul>
No personal data other than IP addresses is ever transmitted to AbuseIPDB.
<ul>
<li>AbuseIPDB Terms of Service and Privacy Policy: https://www.abuseipdb.com/legal</li>
</ul>
<h3>Privacy Policy</h3>
This plugin stores visitor IP addresses in the local WordPress database for the purpose of security logging and blocking. IP addresses are personal data under GDPR.
<ul>
<li>What is stored: IP addresses, associated ISP, country, and event type (e.g. blocked, failed login).</li>
<li>Why: To protect the site from malicious activity and brute-force attacks.</li>
<li>How long: Log entries are automatically deleted after 90 days. Block entries expire based on the configured duration.</li>
<li>Third parties: IP addresses may be sent to AbuseIPDB (https://www.abuseipdb.com) for reputation checks and reporting. See the External Services section for details.</li>
<li>User rights: Site administrators can view and delete all stored data from the plugin’s admin panel or by uninstalling the plugin.</li>
</ul>

Alternatives to GranTech IP Firewall for AbuseIPDB

Top alternatives