Nexiby LLC

Atiqur Rahman

<p>NexiGuard – IP & Geo Access Control is a public WordPress access control plugin for administrators who need to restrict site access using local IP rules and optional GeoIP data.</p>
<p>Features include:</p>
<ul>
<li>Block List mode: visitors matching rules are blocked.</li>
<li>Allow List mode: only visitors matching rules are allowed.</li>
<li>Exact IP address rules.</li>
<li>CIDR range rules for IPv4 and IPv6.</li>
<li>Country and region/state rules when a GeoIP provider is configured.</li>
<li>Optional blocking for the frontend, login page, REST API, and XML-RPC.</li>
<li>403, 404, or custom blocked responses.</li>
<li>Custom blocked messages with plain text and basic safe HTML.</li>
<li>Safe visitor IP detection using REMOTE_ADDR by default.</li>
<li>Optional Cloudflare visitor IP detection.</li>
<li>Optional trusted proxy header support.</li>
<li>Bulk import for IP/CIDR rules.</li>
<li>Export and import settings as JSON.</li>
<li>Optional minimal blocked-attempt logs.</li>
<li>Admin lockout protection and an emergency bypass constant.</li>
</ul>
<h4>Privacy and GeoIP</h4>
<p>IP blocking works without any third-party service. Country and region blocking requires either a readable local GeoIP database or an explicitly configured API provider.</p>
<p>Visitor IP addresses are not sent externally unless an administrator selects API provider mode and configures an API endpoint. Optional logs store only date/time, IP address, matched rule type, and requested path.</p>
<h4>Admin safety</h4>
<p>NexiGuard is disabled by default after activation. Logged-in administrators are never blocked by default. The admin screen displays the detected admin IP and requires confirmation before adding an IP/CIDR rule that matches it.</p>
<p>Emergency bypass: define <code>NEXIGUARD_DISABLE</code> as <code>true</code> in <code>wp-config.php</code> to stop all blocking.</p>
<h3>External Services</h3>
<p>NexiGuard does not contact any external service by default.</p>
<p>If an administrator selects API provider mode and configures an API endpoint, NexiGuard sends a GET request to that administrator-configured endpoint to look up country and region data for visitor IP addresses. The visitor IP address is sent in the configured URL using the <code>{ip}</code> placeholder or as an <code>ip</code> query parameter. If an API key is configured, it is sent as a Bearer token in the Authorization header.</p>
<p>Because the API endpoint is entered by the site administrator, the site owner is responsible for reviewing that provider’s terms of service and privacy policy before enabling API provider mode.</p>
<p>Local IP and CIDR blocking do not use any external service. MaxMind mode reads a local database file and does not send visitor IPs externally.</p>
<h3>License</h3>
<p>NexiGuard – IP & Geo Access Control is licensed under GPL-2.0-or-later.</p>


NexiGuard – IP & Geo Access Control

Restrict website access by IP addresses, CIDR ranges, countries, and regions.

NexiGuard – IP & Geo Access Control vs Advanced IP Blocker