Suspicious IPs
WordPress plugin to identify and block bot traffic
by Joe di Stefano · github.com/joeydi/suspicious-ips · website
★ 0stars
0forks
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/joeydi/suspicious-ips/archive/refs/heads/main.zipMonitor and block suspicious IP addresses based on 404 error patterns from the Redirection plugin.
Features
- 404 Analysis - View IPs with the most 404 errors over a configurable time window, with expandable details showing requested URLs and user agents
- One-Click Blocking - Block suspicious IPs directly from the analysis view
- Blocklist Management - Dedicated tab to add/remove blocked IPs, track hit counts, and export to host deny list format
- Path Blocklist - Auto-block IPs that request known-malicious paths, with an email alert naming the blocked IP and the paths it hit
- Daily Email Digest - Automated daily summary of suspicious activity and recently blocked IPs
- Configurable Thresholds - Set your own limits for what constitutes suspicious behavior
Requirements
- WordPress 5.8+
- PHP 7.4+
- Redirection plugin (for 404 analysis features)
Installation
- Upload the
suspicious-ipsfolder to/wp-content/plugins/ - Activate the plugin through the Plugins menu
- Ensure the Redirection plugin is installed with 404 logging enabled
- Go to Suspicious IPs in the admin menu
How It Works
- The Redirection plugin logs all 404 errors with IP addresses
- Suspicious IPs analyzes these logs to find patterns
- IPs exceeding your configured threshold are highlighted
- Block IPs with one click - they'll receive a 403 Forbidden response
- Daily email digests keep you informed of new threats
Settings
| Setting | Default | Description |
|---|---|---|
| 404 Threshold | 10 | Number of 404s before an IP is flagged |
| Time Window | 24 hours | How far back to analyze 404 logs |
| Email Digest | Enabled | Daily summary of suspicious activity |
| Email Recipients | Admin email | Comma-separated list of recipients |
| Urgent Alerts | Disabled | Hourly alert for high-volume 404 activity |
| Urgent Threshold | 50 | 404s within one hour that trigger an urgent alert |
| Blocklist Auto-block Threshold | 1 | Hits on a blocklisted path within 24 hours before auto-blocking |
| Blocklist Alerts | Enabled | Email when an IP is auto-blocked by the path blocklist |
See CHANGELOG.md for version history.