About this plugin
Blockary blocks visitors by country and stops password guessing on the login page.
The country rule works as a block list or as an allow list. You pick the countries on the settings page. The plugin reads the country from the Cloudflare header or from a local copy of the free “IP to Country Lite” database from DB-IP.
Visitors from the whitelist and from private networks always pass. Logged-in users pass by default. You can turn that off on the settings page.
Administrators always pass. A setting lets the Google crawlers pass the country rule, so that Google can index the site when the rule blocks the United States. The plugin verifies a crawler by its address against the list that Google publishes, not by its user agent.
The login protection counts failed logins per address and per username. An address that reaches the limit gets a temporary ban. The ban time grows with each ban, and a permanent ban follows after a number of temporary bans.
The plugin can also lock a username, show the same error for a wrong username and a wrong password, hide usernames from visitors, and turn off XML-RPC.
The plugin loads as the first plugin. It decides a request without a login cookie before WordPress loads the other plugins. It decides a request with a login cookie as soon as WordPress can read that cookie.
Blocked requests do not reach the theme. A log on the settings page shows the blocked requests, the failed logins, and the bans.
Load order
The plugin keeps itself first in the list of active plugins. WordPress then loads it before the other plugins, so a blocked request costs less and stays invisible to the other plugins. The plugin changes only the order of that list in the database.
It writes no file for this and you do not have to set anything up.
Optional: the loader file
A loader file in the folder wp-content/mu-plugins is only useful when another plugin moves itself in front of Blockary. The plugin does not write that file itself. You download it on the settings page and copy it into the folder by hand, for example with SFTP.
The settings page shows the exact path. The loader runs the decision only while the plugin is active. Without the plugin it does nothing.
When you delete the plugin, delete the loader file too. When the settings page shows “Outdated” for the load order, download the file again and replace the copy.
Recovery
php:
define( 'BLOCKARY_DISABLE', true );
The plugin then blocks nothing until you remove the line.
External services
The plugin downloads the country database “IP to Country Lite” from DB-IP when you select the local database as the country source. The download runs once after you select that source and then once a month through WP-Cron. You can also start it on the settings page.
com/free/. The request carries only the name of the database file for the current month. It carries no data about your site or your visitors.
0. The settings page shows the attribution link that the license requires.
php
While the setting “Let search engine crawlers pass the country rule” is on, the plugin downloads the lists of crawler addresses that Google, Bing, DuckDuckGo, and Apple publish. The setting is on by default. The first download runs through WP-Cron within a day after the activation, or after you save the setting.
After that the plugin refreshes the lists once a week while the setting is on. The plugin ships a copy of each list, so the setting works before the first download.
The requests go to these four files. They carry no data about your site or your visitors.
- https://developers.google.com/static/crawling/ipranges/common-crawlers.json. Terms and privacy policy of Google: https://policies.google.com/terms and https://policies.google.com/privacy
- https://www.bing.com/toolbox/bingbot.json. Terms and privacy policy of Microsoft: https://www.microsoft.com/servicesagreement and https://privacy.microsoft.com/privacystatement
- https://duckduckgo.com/duckduckbot.json. Terms and privacy policy of DuckDuckGo: https://duckduckgo.com/terms and https://duckduckgo.com/privacy
- https://search.developer.apple.com/applebot.json. Terms and privacy policy of Apple: https://www.apple.com/legal/internet-services/terms/site.html and https://www.apple.com/legal/privacy/
The plugin sends no other request to an external service.