Ipstenu (Mika Epstein)

We’ve all had this problem: a group of spammers from <code>mail.ru</code> are registering to your blog, but you want to keep registration open. How do you kill the spammers without bothering your clientele? While you could edit your theme’s <code>functions.php</code> and block the domain, once you get past a few bad eggs, you have to escalate.
Ban Hammer helps you do that by preventing unwanted users from registering.
On a single install of WordPress, instead of using its own database table, Ban Hammer pulls from your list of prohibited emails from the Disallowed Comment Keys feature, native to WordPress. Since emails never equal IP addresses, it simply skips over and ignores them.
On a network instance, there’s a network wide setting for banned emails and domains. This means you only have one place to update and maintain your blocked list. When a listed user attempts to register, they get a customizable message that they cannot register.
For advanced documentation, including how to use on WooCommerce, please visit <a href="https://github.com/Ipstenu/ban-hammer/wiki" rel="nofollow ugc">the Ban Hammer Wiki</a>.
<ul>
<li><a href="https://github.com/Ipstenu/ban-hammer/" rel="nofollow ugc">Development</a></li>
<li><a href="https://github.com/Ipstenu/ban-hammer/wiki" rel="nofollow ugc">Wiki</a></li>
<li><a href="https://ko-fi.com/A236CEN/" rel="nofollow ugc">Donate</a></li>
</ul>
<h4>Privacy Policy</h4>
This plugin does not track data outside of what WordPress already collects. It utilizes the submitted email address to validate the domain and compares it to the list of prohibited domains and emails. No additional data is processed.
<h4>Credits</h4>
Ban Hammer is a very weird fork of <a href="http://www.joeswebtools.com/wordpress-plugins/no-disposable-email/" rel="nofollow ugc">Philippe Paquet’s No Disposable Email plugin</a>. The original plugin was a straight forward .dat file that listed all the bad emails (generally ones like mailinator that are disposable) and while Ban Hammer doesn’t do that, this would not have been possible without that which was done before.
Many thanks are due to WP-Deadbolt, for making me think about SQL and TTC for StopForumSpam integration. MASSIVE credit to Travis Hamera for the StopForumSpam/cURL fix! And then props to Helen Hou-Sandí for not using curl at all. Protip? Use <a href="http://planetozh.com/blog/2009/08/how-to-make-http-requests-with-wordpress/" rel="nofollow ugc">WP_http</a> instead!

Ban Hammer

Prevent people from registering via your disallowed comment keys.

By far the simplest country allowlist plugin available for WordPress. Locks admin panel and XMLRPC access to a given list of allowed countries using <a href="https://apis.qweb.co.uk/ip-lookup/" rel="nofollow ugc">QWeb’s IP to country lookup API</a>.
This is free open source software (FOSS), which you’re welcome to either use as-is, or fork and further develop under the very permissive terms of the <a href="LICENSE" rel="nofollow ugc">MIT license</a>.
Out of the box, this is most likely the simplest, most efficient plugin for restricting access to your WordPress admin panel to an allowlist of specific countries. Simply install and activate the plugin, obtain an access key via the QWeb Ltd API console, and enter your access key in the plugin settings. The plugin will automatically determine your own country and add this to the allowlist, and you can add other countries to the list as you like.
Countries are entered as comma separated <a href="https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements" rel="nofollow ugc">ISO 3166-1 alpha-2 country codes</a> in a single field, making it super easy to copy & paste the same list across multiple websites.
This plugin also restricts access to the WordPress XMLRPC mechanism, using the same country allowlist.
You can optionally choose to allow or disallow access through known public proxy servers, even if they’re located in an allowed country.
The plugin creates a cache of IP information and automatically clears cache files older than one week. This reduces the number of lookup requests and keeps your website responsive, without creating an unnecessarily large cache.
As a single 25kb file, this is an exceptionally lightweight plugin. Built to be efficient, and using QWeb’s incredibly responsive <a href="https://apis.qweb.co.uk/ip-lookup/" rel="nofollow ugc">IP lookup API</a>, the Admin Country Allowlist plugin should be a part of your standard security kit for any WordPress websites that you manage.
This plugin relies on <a href="https://apis.qweb.co.uk/ip-lookup/" rel="nofollow ugc">QWeb’s IP to country lookup API</a> for IP to country lookups, and will not function without an active API key from this service. QWeb does provide a FREE tier for this API service, suitable for most websites. Please refer to the <a href="https://apis.qweb.co.uk/console/eula" rel="nofollow ugc">QWeb Ltd API Terms of Use</a> and <a href="https://www.qweb.co.uk/privacy-policy" rel="nofollow ugc">QWeb Ltd Privacy Policy</a>.

Admin Country Allowlist

By far the simplest country allowlist plugin available. Locks admin panel and XMLRPC access to a given list of allowed countries.

Ban Hammer vs Admin Country Allowlist