supersoju

<p><strong>Block Logins with Cloudflare</strong> helps protect your WordPress site from brute-force attacks by blocking IPs at the Cloudflare firewall after a configurable number of failed login attempts.</p>
<ul>
<li>Block IPs via Cloudflare after X failed login attempts</li>
<li>Block IPs that generate excessive 404 responses (bots and scanners)</li>
<li>Block IPs attacking via XML-RPC with intelligent detection</li>
<li>Automatic unblocking after a configurable duration</li>
<li>Whitelist IPs to never block or track them (supports IPv6 CIDR ranges)</li>
<li>View and manually unblock blocked IPs from the admin</li>
<li>Block source tracking — see whether each IP was blocked via login, XML-RPC, or 404</li>
<li>Sync existing Cloudflare blocks into the local blocked IPs list</li>
<li>Secure settings page with Cloudflare API token validation</li>
<li>Hourly cron job for automatic maintenance</li>
</ul>
<h3>External Services</h3>
<p>This plugin relies on the <strong>Cloudflare API</strong> to function. It communicates with Cloudflare’s external servers to block IP addresses at the firewall level.</p>
<p><strong>What is the Cloudflare API and what is it used for?</strong><br />
The Cloudflare API is a RESTful service provided by Cloudflare, Inc. that allows programmatic management of Cloudflare firewall rules. This plugin uses it to automatically block and unblock IP addresses based on failed login attempts, XML-RPC attacks, and 404 scanning activity.</p>
<p><strong>What data is sent and when?</strong><br />
The plugin sends the following data to Cloudflare’s API servers:</p>
<ol>
<li>
<p><strong>During settings validation</strong> (when you save Cloudflare credentials):</p>
<ul>
<li>Your Cloudflare API token (for verification)</li>
<li>Endpoint: <code>https://api.cloudflare.com/client/v4/user/tokens/verify</code></li>
</ul>
</li>
<li>
<p><strong>When blocking an IP</strong> (after a threshold is reached):</p>
<ul>
<li>The IP address to be blocked</li>
<li>Your Cloudflare email address and API key/token</li>
<li>Your Cloudflare Zone ID</li>
<li>A note describing the reason for the block</li>
<li>Endpoint: <code>https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/access_rules/rules</code></li>
</ul>
</li>
<li>
<p><strong>When syncing from Cloudflare</strong> (on demand):</p>
<ul>
<li>Fetches existing firewall rules from your Cloudflare zone</li>
<li>Endpoint: <code>https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/access_rules/rules</code></li>
</ul>
</li>
</ol>
<p>No personally identifiable information about your WordPress users is transmitted. Only IP addresses are sent to Cloudflare.</p>
<p><strong>Service provider information:</strong><br />
– Service: Cloudflare API<br />
– Provider: Cloudflare, Inc.<br />
– Terms of Service: https://www.cloudflare.com/terms/<br />
– Privacy Policy: https://www.cloudflare.com/privacypolicy/<br />
– API Documentation: https://developers.cloudflare.com/api/</p>
<p><strong>Required for functionality:</strong><br />
This plugin requires a Cloudflare account and will not function without valid Cloudflare API credentials. The external API calls are essential to the plugin’s core functionality.</p>
<h3>License</h3>
<p>GNU General Public License v2 or later</p>


Block Logins with Cloudflare

Block brute-force login attempts by integrating with Cloudflare's firewall to automatically block IPs after failed logins.

Sami Ahmed Siddiqui

Aliya Yasir

<p>This plugin empowers you to set up HTTP Authentication for your website. This adds an extra layer of security by requiring a username and password to access specific areas.</p>
<p>Here’s how it benefits you:</p>
<ul>
<li><strong>Enhanced Admin Security:</strong> Shield your admin pages from brute-force attacks by adding a login barrier.</li>
<li><strong>Controlled Crawling:</strong> Restrict crawlers from accessing your site during development, preventing unnecessary indexing.</li>
<li><strong>Post-Launch Access Control:</strong> Maintain control over admin page access even after your website goes live.</li>
<li><strong>Easy Activation/Deactivation:</strong> Conveniently enable or disable HTTP Auth without deactivating the plugin entirely.</li>
</ul>
<h3>Help Us Improve!</h3>
<p>I am constantly working to enhance this plugin and your feedback is valuable. If you are happy with the plugin, consider leaving a review on WordPress.org. Your positive feedback motivates us to keep improving!</p>
<p>Link to Reviews: <a href="" rel="nofollow ugc">https://wordpress.org/support/plugin/http-auth/reviews/?rate=5#new-post</a></p>
<h3>Bug Reports</h3>
<p>We welcome bug reports for HTTP Auth on GitHub: <a href="https://github.com/samiahmedsiddiqui/http-auth" rel="nofollow ugc">https://github.com/samiahmedsiddiqui/http-auth</a>. Please remember that GitHub is primarily for bug reporting, and issues not classified as genuine bugs may be closed.</p>
<h3>From within WordPress</h3>
<ol>
<li>Visit ‘Plugins > Add New’</li>
<li>Search for HTTP Auth</li>
<li>Activate HTTP Auth from your Plugins page.</li>
<li>Go to “after activation” below.</li>
</ol>
<h3>Manually</h3>
<ol>
<li>Upload the <code>http-auth</code> folder to the <code>/wp-content/plugins/</code> directory</li>
<li>Activate HTTP Auth through the ‘Plugins’ menu in WordPress</li>
<li>Go to “after activation” below.</li>
</ol>
<h3>After activation</h3>
<ol>
<li>Go to the plugin settings page and set up the plugin for your site.</li>
<li>You’re done!</li>
</ol>


HTTP Auth

Provides comprehensive security during development by protecting your entire site and your admin pages from brute-force attacks.

Block Logins with Cloudflare vs HTTP Auth