Behnam Moradi

NetShield – Request Blocker helps WordPress administrators identify and block external HTTP requests that the server cannot reach due to network restrictions, firewalls, or internet access limitations.
On restricted or internal networks, WordPress and plugins often make dozens of outbound HTTP requests on every page load (to Google Fonts, CDNs, analytics services, etc.). When those endpoints are unreachable, each request stalls and waits for a timeout — silently slowing your site down.
NetShield solves this by:
<ol>
<li>Scanning a curated list of common external endpoints using the WordPress HTTP API.</li>
<li>Identifying which ones are unreachable from your server.</li>
<li>Blocking future requests to those endpoints via WordPress’s <code>pre_http_request</code> filter — so they never wait for a timeout again.</li>
</ol>
<h4>Key Features</h4>
<ul>
<li>On-demand network scanner — test 27 common external endpoints (WordPress.org, Google APIs, CDNs, social platforms, analytics).</li>
<li>Selective blocking — choose which unreachable addresses to block; toggle any entry on/off without deleting it.</li>
<li>Manual entries — add any domain, URL, or IP address to the block list manually.</li>
<li>Context-aware rules — block requests only on the admin side, only on the frontend, or both.</li>
<li>Bulk actions — enable, disable, or delete multiple entries at once.</li>
<li>Graphical settings page — modern, tab-based admin UI with real-time stats, toast notifications, and toggle switches.</li>
<li>Master switch — enable or disable the plugin’s blocking functionality instantly without deactivating it.</li>
<li>Auto-block on scan — optionally mark all unreachable URLs as blocked automatically after each scan.</li>
<li>Transient caching — blocked URL lists are cached in WordPress transients for optimal performance.</li>
<li>Clean uninstall — all data (database table, options, transients, capabilities) is removed on plugin deletion.</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>WordPress sites hosted on intranets or servers with restricted outbound internet access.</li>
<li>Development environments behind corporate firewalls.</li>
<li>Any WordPress site where external HTTP request timeouts are causing slow admin or frontend load times.</li>
</ul>
<h4>Technical Details</h4>
<ul>
<li>Uses WordPress <code>pre_http_request</code> filter for zero-overhead blocking (no request is even initiated).</li>
<li>Custom database table (<code>wp_nsb_blocked_urls</code>) for storing and managing blocked entries.</li>
<li>REST API endpoints (<code>/wp-json/netshield/v1/</code>) for all admin UI interactions.</li>
<li>PHP 8.1+ with strict typing, readonly DTOs, and backed enums.</li>
<li>No external dependencies — no Composer required, built-in PSR-4 autoloader.</li>
</ul>

NetShield – Request Blocker

Scans and blocks unreachable or unwanted external HTTP requests to dramatically optimize WordPress loading speed on restricted networks.

cheesefather

After the recent global distributed botnet attack on WordPress installations that took down servers and broke into admin accounts, I thought I’d write a plugin to prevent it happening again.
Distributed botnet attacks can come from multiple IP addresses and locations at the same time, so conventional IP-based lockouts are not effective (e.g. those found in Wordfence and other WordPress security plugins).
For example, if 1,000 different computers (with unique IP addresses) are trying to brute-force your admin password and you lock out each IP address after 5 incorrect attempts then you have still allowed 5,000 attempts. My plugin essentially ignores the different IP addresses and locks out all admin login attempts in a configurable way – so if you have it set to 5 failed attempts (default) then those 1,000 different computers will only have a total between them of 5 attempts.
You can select how many login failures causes the lockout, how much time to allow between failures, how long to block logins for and also you can input a whitelisted IP address (or multiple addresses separated with commas or spaces) which can bypass the lockdown and always log in – so you can still always get into your site even in the middle of an attack. There is also support for partial IP address matching for those with dynamic IP addresses. You can also define a secret key to bypass the lock.
<ul>
<li>Any failed login is counted regardless of username or IP address (unless whitelisted)</li>
<li>Once locked down, nobody can log in except from whitelisted IP addresses or using the secret key</li>
<li>You can specify the number of login failures that triggers a lockdown</li>
<li>You can specify the time between failed attempts that should be counted</li>
<li>You can specify how long the lockdown should last</li>
<li>You can add a secret key that bypasses the lockdown</li>
<li>You can customise the lockout message</li>
<li>You can add whitelisted IP addresses that bypass the lockdown</li>
<li>Partial IP address matching for dynamically-allocated IP addresses</li>
<li>Multisite compatible</li>
<li>Available in English, French, German, Italian and Russian</li>
</ul>

Botnet Attack Blocker

This plugin blocks distributed botnet brute-force attacks on your Wordpress installation.

NetShield – Request Blocker vs Botnet Attack Blocker