supersoju

Block Logins with Cloudflare helps protect your WordPress site from brute-force attacks by blocking IPs at the Cloudflare firewall after a configurable number of failed login attempts.
<ul>
<li>Block IPs via Cloudflare after X failed login attempts</li>
<li>Block IPs that generate excessive 404 responses (bots and scanners)</li>
<li>Block IPs attacking via XML-RPC with intelligent detection</li>
<li>Automatic unblocking after a configurable duration</li>
<li>Whitelist IPs to never block or track them (supports IPv6 CIDR ranges)</li>
<li>View and manually unblock blocked IPs from the admin</li>
<li>Block source tracking — see whether each IP was blocked via login, XML-RPC, or 404</li>
<li>Sync existing Cloudflare blocks into the local blocked IPs list</li>
<li>Secure settings page with Cloudflare API token validation</li>
<li>Hourly cron job for automatic maintenance</li>
</ul>
<h3>External Services</h3>
This plugin relies on the Cloudflare API to function. It communicates with Cloudflare’s external servers to block IP addresses at the firewall level.
What is the Cloudflare API and what is it used for? 
The Cloudflare API is a RESTful service provided by Cloudflare, Inc. that allows programmatic management of Cloudflare firewall rules. This plugin uses it to automatically block and unblock IP addresses based on failed login attempts, XML-RPC attacks, and 404 scanning activity.
What data is sent and when? 
The plugin sends the following data to Cloudflare’s API servers:
<ol>
<li>
During settings validation (when you save Cloudflare credentials):
<ul>
<li>Your Cloudflare API token (for verification)</li>
<li>Endpoint: <code>https://api.cloudflare.com/client/v4/user/tokens/verify</code></li>
</ul>
</li>
<li>
When blocking an IP (after a threshold is reached):
<ul>
<li>The IP address to be blocked</li>
<li>Your Cloudflare email address and API key/token</li>
<li>Your Cloudflare Zone ID</li>
<li>A note describing the reason for the block</li>
<li>Endpoint: <code>https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/access_rules/rules</code></li>
</ul>
</li>
<li>
When syncing from Cloudflare (on demand):
<ul>
<li>Fetches existing firewall rules from your Cloudflare zone</li>
<li>Endpoint: <code>https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/access_rules/rules</code></li>
</ul>
</li>
</ol>
No personally identifiable information about your WordPress users is transmitted. Only IP addresses are sent to Cloudflare.
Service provider information: 
– Service: Cloudflare API 
– Provider: Cloudflare, Inc. 
– Terms of Service: https://www.cloudflare.com/terms/ 
– Privacy Policy: https://www.cloudflare.com/privacypolicy/ 
– API Documentation: https://developers.cloudflare.com/api/
Required for functionality: 
This plugin requires a Cloudflare account and will not function without valid Cloudflare API credentials. The external API calls are essential to the plugin’s core functionality.
<h3>License</h3>
GNU General Public License v2 or later

Block Logins with Cloudflare

Block brute-force login attempts by integrating with Cloudflare's firewall to automatically block IPs after failed logins.

WPChef

This plugin resolves performance issues caused by brute force attacks described in the WordPress Codex here: <a href="https://codex.wordpress.org/Brute_Force_Attacks" rel="nofollow ugc">https://codex.wordpress.org/Brute_Force_Attacks</a>
<blockquote>
From WordPress Codex:
Due to the nature of these attacks, you may find your server’s memory goes through the roof, causing performance problems. This is because the number of http requests (that is the number of times someone visits your site) is so high that servers run out of memory.
A common attack point on WordPress is to hammer the wp-login.php file over and over until they get in or the server dies. You can do some things to protect yourself.
</blockquote>
Protection Against DDoS plugin addresses these issues very well.
It also allows to deny access to common WordPress features that get frequently attacked, like xmlrpc or RSS feeds pages.
CloudFlare users can allow or deny access for visitors from specified countries.
All checks are done via the .htaccess file so that bogus requests can’t even reach your WordPress site and get bounced at the web server level. You can also specify exactly where they can be bounced to.
<h4>Compatibility</h4>
<ul>
<li>Doesn’t have any known conflicts with any other security plugins.</li>
<li>Fully compatible with WordPress multisites.</li>
</ul>
Advanced users can get more technical information on the <a href="https://wordpress.org/plugins/protection-against-ddos/faq/" rel="ugc">FAQ page</a>.

Protection Against DDoS

We use this when a WordPress site gets bombarded with bogus traffic and see the results within minutes. We can see how HTTP requests drop right after the plugin is installed. This plugin should be a must for any site.



Works very well

Protects your login, xmlrpc and RSS feeds pages against DDoS attacks. Denies access to your site from certain countries via CloudFlare.

Block Logins with Cloudflare vs Protection Against DDoS