Sky Monitor

FerUlisses

<p>Simple Login Limit & Protect is a Plugin designed to protect your WordPress site from hackers, crackers and other attackers, with simple configuration and with minimum problems for legitimate users.</p>
<p>Using the same technology used in the most advanced Security Tools, our plugin works as soon as activated, detecting malicious behavior and automatically blocking attackers.</p>
<h4>Key Features</h4>
<ul>
<li>Behavioral Intelligent Learning, detect the behavior of users to distinguish the bad guys from good guys</li>
<li>Really GDPR Compliant <a href="https://skymonitor.com/why-hash-dont-anonimize-an-ip-address-and-what-this-affects-gdpr/" rel="nofollow ugc">(why some others plugins don’t comply)</a></li>
<li>Minimum Configuration, just install and don’t mind looking for the settings, works out of the box</li>
</ul>
<h4>Behavioral Intelligent Learning</h4>
<p>We expect legitimate users to behavior in a certain way. In the other side, hackers usually start with simple commoditized scripts, we studied these scripts and implemented detection rules for them.</p>
<p>We studied attackers techniques such as User Enumeration, Brute Force Attack, the Most Common Passwords Used and developed sensors to these behaviours, identifying the remote user as an attacker.</p>
<p>In the other side, legitimate users normally use the same Provider, with a common Internet browser and in an certain way, we also detect this behaviour and identify them as a good user.</p>
<h4>Automatically allow legitimate users to try again</h4>
<p>If a legitimate user is blocked due to missing his password, the plugin will inform the user how much time he have to wait before he can try again, minimising support.</p>
<p>On the first missed password tries, the plugin will allow the user to try again in a few minutes with a message, this removes work from the Site Administrator.</p>
<p>If necessary, the user can use the WordPress “Lost your password” feature to generate a new one if he forgot to not be blocked again.</p>
<p>But if it’s a hacker that continues to try invalid passwords he will be blocked again for even increased times (limited to 24 hours).</p>
<h4>Full list of Features</h4>
<ul>
<li>Detect and block malicious users</li>
<li>Detect and block Brute Force Attacks</li>
<li>Detect User Enumeration Attacks</li>
<li>Inform legitimate users if they are blocked</li>
<li>Detect if a hacker is not using HTTPS</li>
<li>Detect if a hacker is using scripts</li>
<li>Detect the most commons attack tools to WordPress sites, such as Hydra, Curl, MetaSploit, Kalil</li>
<li>Detect if the attacker is using a password dictionary to guess passwords</li>
<li>Block the IP of the attacker</li>
<li>Allow a legitimate user to try again after a few minutes</li>
<li>If the attacker continues, block again for 30 minutes</li>
<li>If the attacker continues, block for 24 hours</li>
<li>Counts and inform the Administrator how much attacks has been blocked</li>
<li>Detect and works automatically with Sucuri Web Firewall</li>
<li>Detect and suggest configuration for Proxies and Load Balancers</li>
<li>Detect and block attacks to XMLRPC API (not all plugins do this)</li>
<li>Detect attacks to REST API for user enumeration (no other plugin do this)</li>
</ul>
<h3>Installation Instructions</h3>
<h4>On WordPress Admin Dashboard</h4>
<ol>
<li>Visit <code>Plugins > Add New</code></li>
<li>Search for <code>Simple Login Limit & Protect</code>. Find and install the plugin</li>
<li>In <code>Plugins > Installed Plugins</code>, click in Activate</li>
</ol>
<h4>Downloading From WordPress.org</h4>
<ol>
<li>Download Simple Login Limit & Protect zip file.</li>
<li>Visit <code>Plugins > Add New</code> in your WordPress Admin Dashboard</li>
<li>Click in <code>Upload Plugin</code></li>
<li>Click in <code>Choose File</code>, find the downloaded file in your computer</li>
<li>Click in <code>Install Now</code></li>
<li>In <code>Plugins > Installed Plugins</code>, click in Activate.</li>
</ol>
<h4>Manually via FTP, SFTP</h4>
<ol>
<li>Download Simple Login Limit & Protect zip file.</li>
<li>Unzip and upload the <code>simple-login-limit-protect</code> directory to your <code>/wp-content/plugins/</code> directory</li>
<li>Enter in your WordPress Admin Dashboard</li>
<li>In <code>Plugins > Installed Plugins</code>, click in Activate.</li>
</ol>
<h3>Demo Video</h3>
<p><iframe loading="lazy" title="Demo Simple Login Limit Protect EN" width="750" height="563" src="https://www.youtube.com/embed/J9DolDG7vU0?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe></p>


Simple Login Limit & Protect

Simple Login Limit & Protect is designed to protect your WordPress from hackers, with easy configuration, automatically learns from user behaviour …

veppa

<h4>Prevent WP HTTP requests from slowing down your WordPress website and admin interface</h4>
<p>Do you have a slow WordPress admin that takes longer than usual to load? Sometime longer than 5 seconds to load admin or login pages. In rare occasions WordPress may even timeout and show 504 page.</p>
<p>Reason may be slow external WP_HTTP requests. <a href="https://veppa.com/http-requests-manager/" rel="nofollow ugc">HTTP Requests Manager plugin</a> will log all WP HTTP requests with time taken to complete for each request. If there are multiple requests per page they will be color grouped.</p>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/l_fvAnKPJkM?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<p><a href="https://youtu.be/l_fvAnKPJkM" rel="nofollow ugc">Check plugin overview on YouTube</a> | <a href="https://youtube.com/playlist?list=PLvn-qBzU0II7b5D4OYDnKpNpuvxiM0f4b" rel="nofollow ugc">Watch plugin tutorials</a></p>
<p>Plugin tested with PHP version 5.6, 7.x and up to 8.4.</p>
<h4>Do not confuse WP_HTTP request with HTML requests that loads page assets like js, css, image, font</h4>
<p>Plugin only detects and manages requests made using WP_Http class. Which is default method used and advised by WordPress for getting remote data and updates.</p>
<p>Plugin will not detect any requests made by other WordPress classes like WP_Http_Curl or PHP functions like curl_exec, fsockopen, file_get_contents etc.</p>
<p>Do not confuse it with HTML requests (loading assets like css, js, image) done by HTML page. WP_Http requests are performed only inside PHP files and not visible in web browser.</p>
<p><a href="https://veppa.com/http-requests-manager/#what_is_detected_with_http_requests_manager" rel="nofollow ugc">Learn more about difference between WP_HTTP requests and HTML requests</a></p>
<h4>How plugin prevents slow pages containing WP_HTTP requests?</h4>
<p>Plugin helps to prevent website slowdown by:</p>
<ul>
<li>Sets request timeout period to 2 second. Where default is 5. </li>
<li>Limit number of request per page by 3. Default is unlimited.</li>
<li>Limit WP HTTP request if page load time is longer than 3 seconds. Default is unlimited.</li>
<li>Option to block all external requests or allow only requests to wordpress.org for plugin, theme and core updates.</li>
</ul>
<h4>Operation mode</h4>
<p>Plugin has following operation modes in setting to manage WP HTTP requests. Here is what each mode does:</p>
<ul>
<li><strong>Only log HTTP requests</strong> — logs all non cron requests. No blocking done.</li>
<li><strong>Only log HTTP requests (+ cron requests)</strong> — logs all requests including cron. No blocking done.</li>
<li><strong>Smart block</strong> — logs non cron HTTP requests and blocks request using following rules.
<ol>
<li>Page processing time exceeded 3 seconds.</li>
<li>Number of request for single page reached 3.</li>
<li>Sets timeout for each request to 2 second.</li>
<li>Sets number of redirects for request to 1.</li>
<li>Apply custom rules for “Smart block” defined in settings. </li>
<li>Prevent some built in requests: happy browser, maybe update, self pings, do_enclose.</li>
<li>Skip some limitations listed above for: file downloads (plugin, theme, other), requests inside cron jobs.</li>
</ol>
</li>
<li><strong>Block external requests</strong> — all requests not matching your current domain will be blocked. No updates for WordPress core, plugins and themes. (+ Smart block features.)</li>
<li><strong>Block external requests (allow WordPress.org only)</strong> — all requests not matching your current domain and wordpress.org will be blocked. Allows updates for WordPress core, plugins and themes coming from wordpress.org website. (+ Smart block features.)</li>
</ul>
<p><strong>Custom rules</strong> only work in “Smart block” mode. It will not work in “Block external requests” or “Block external requests (allow WordPress.org only)” mode.</p>
<h4>Disable logging</h4>
<p>After using plugin for some time and knowing which requests are performed you can disable logging. Operation mode will remain unchanged. Request blocking will remain in tact. No new logs will be recorded. You can analyze old logs, they will not be deleted.</p>
<h4>Load before other plugins</h4>
<p>In order to catch more requests you can enable “Load before other plugins” option. It uses Must-Use plugin feature and load before other regular plugins. This way you will make sure to detect all WP_HTTP requests by other plugins.</p>
<h4>Custom rules for “Smart Block” mode</h4>
<p>Allow or block some requests based on domain, plugin or all. Choose on which page type rule will be applied. For example you can block requests in frontend while allowing in other pages.</p>
<p>Finally you can define action as block or allow for custom rule. For example you can make sure that some plugin will always be allowed to send WP_HTTP request. This can be SEO or mail plugin that uses remote API for functioning.</p>
<h4>Features</h4>
<ul>
<li>View performance improvement of your WordPress website due to blocking some remote HTTP requests.</li>
<li>View blocked requests by this plugin. Show reason why it was blocked.</li>
<li>View failed requests with error message.</li>
<li>View what initiated HTTP request: WordPress core, plugin or theme.</li>
<li>View on which page request was made. Also view page type is frontend, admin, login, cron, ajax, xmlrpc or rest_api. </li>
<li>View list of other requests made on same page view. </li>
<li>View sent and received data.</li>
<li>How long it took to get response in seconds. </li>
<li>Check Point with page time and memory usage for most common hooks like plugins_loaded, init, wp_loaded, setup_theme, after_setup_theme, shutdown. This will give some idea about cause of slow pages.</li>
<li>Only last 1000 records will be stored. </li>
<li>Group requests by URL, domain, initiator, plugin, page, response status etc. </li>
<li>Add custom rules (conditional logic) to block or allow certain requests. </li>
</ul>
<p>Log summary populated for visible logs in selected page. Summary has following information cards:</p>
<ul>
<li>Performance gain quantifier (2x) as a result of optimization. </li>
<li>Blocked requests percentage. When hovered it will show request breakdown by core, plugins or theme.</li>
<li>Number of requests per page. When hovered shows breakdown by page type: Frontend, admin, login, cron, ajax, xmlrpc, rest_api.</li>
<li>Request time / Page time percentage.</li>
<li>Average page time.</li>
<li>Average request time.</li>
<li>Number of domains. On hover shows breakdown of domains. </li>
</ul>
<h4>Use cases</h4>
<ul>
<li>Check if WordPress communication to remote APIs works without any problem. — <a href="https://veppa.com/debug-wp_http/" rel="nofollow ugc">Check how easy it is to debug WP_HTTP requests <span aria-hidden="true" class="wp-exclude-emoji">→</span></a> </li>
<li>Identify if your website slow because of WP_HTTP requests. Average page load time, average request time and average number of requests per page shown as summary at the top of reports. </li>
<li>Block all external request on development or localhost website. All updates will be blocked. You switch off blocking when you want to perform Core, Plugin, Theme updates. No need to use <strong>define(‘WP_HTTP_BLOCK_EXTERNAL’, true);</strong> in your wp-config.php. Plugin will prevent requests automatically when you choose “Block external requests” or “Block external requests (allow WordPress.org only)” operation mode. </li>
<li>Block non WordPress request. No data will be sent to third parties. They are usually loading other website news, plugin/theme promotions, advertisements, sending usage statistics etc. </li>
<li>Prevent your website from timeout. By blocking all requests if page generation time exceeds 3 seconds. Kill slow HTTP request with small timeout of 2 second. Slow request can be because of temporary network problem or remote website can be too busy to respond on time. Slow request is not your fault so your website should not suffer from it. — <a href="https://veppa.com/optimize-wp-http-requests/" rel="nofollow ugc">Learn how WP_HTTP Optimization works <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></li>
</ul>
<p><a href="https://veppa.com/http-requests-manager/" rel="nofollow ugc">More info about “HTTP Requests Manager” plugin on official home page <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></p>
<h4>Credits</h4>
<ul>
<li>Initial logging functionality was taken from <a href="https://github.com/FacetWP/log-http-requests" rel="nofollow ugc">Log HTTP Requests (version 1.4, year 2023) Github <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></li>
<li>Blocking, grouping and additional features added by <a href="https://veppa.com/" rel="nofollow ugc">veppa <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></li>
</ul>
<h4>What’s next</h4>
<p>If you find this plugin useful to view WP_HTTP requests and speeding up your admin pages by blocking some requests then give good rating. Also check my other projects:</p>
<ul>
<li><a href="https://veppa.com/improve-pagespeed/" rel="nofollow ugc">Tutorial to get high PageSpeed Score</a> — video showing how I get PageSpeed Score 100 for my own website powered by WordPress CMS.</li>
<li><a href="https://veppa.com/wordpress-cloudflare-optimization/" rel="nofollow ugc">Cloudflare Custom Rules</a> — pluginsless solutions for Page Cache, Antibot (prevents automated spam comments and brute-force login attacks) etc.</li>
<li><a href="https://veppa.com/share-button/" rel="nofollow ugc">Share button without plugin</a> — add super fast native sharing button to your website. Tiny inline code, ad blocker safe, no external dependencies.</li>
<li><a href="https://veppa.com/bbpress-wp-tweaks/" rel="nofollow ugc">bbPress WP Tweaks</a> — add custom sidebar, additional widgets and forum columns for sites powered with bbPress forum plugin.</li>
</ul>
<p>Visit veppa.com to learn from my <a href="https://veppa.com/category/learn-wordpress/" rel="nofollow ugc">WordPress tutorials</a>.</p>


HTTP Requests Manager


Most of the delays in WP admin are http phone home calls.



This plugin solves exactly that, and you can see who the worst culprits are, too!



This belongs on every WordPress site by default.



Thanks for your amazing work @veppa !



(Small request: can we have a setting to tweak that max page loading time down from 3 seconds? Perhaps options for 3.0, 2.5, 2.0, 1.5, 1.0, 0.5, maybe 1.5 as the default?)


Fastest speedup in wp admin you can get!

Limit, Debug, Optimize WP_HTTP requests. Limit by request count, page load time, reduce timeout for each request. Speed up login and admin pages.

Simple Login Limit & Protect vs HTTP Requests Manager