WP Manifestindependent plugin directory
manifest / security / cf-login-guard

CF Login Guard

Adds IP addresses to a Cloudflare list when login or password reset attempts use blocked usernames (e.g. admin, root). Pair with a Cloudflare WAF custom rule to block listed IPs.

by Khairil Zhafri · github.com/khrlzhfr/cf-login-guard · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/khrlzhfr/cf-login-guard/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/khrlzhfr/cf-login-guard ↗

Adds attacker IPs to a Cloudflare list when blocked usernames are used on login or password reset forms.

Description

CF Login Guard monitors WordPress login and password reset attempts. When someone submits a username that appears on your blocked list (e.g. admin, administrator, root), the plugin captures their IP address and adds it to a Cloudflare list via the Lists API.

The plugin does not block traffic itself. You configure a WAF custom rule in Cloudflare to block (or challenge) IPs that appear on the list. This keeps the blocking logic at the edge, where it belongs.

How it works:

  1. A visitor submits a login or password reset form.
  2. The plugin checks the username against a configurable blocked list.
  3. If the username matches and the IP is not on the allowed list, the IP is added to your Cloudflare list.
  4. Your Cloudflare WAF custom rule handles the actual blocking.

Features:

  • Hooks into both authenticate and lostpassword_post.
  • Reads the real visitor IP from the CF-Connecting-IP header.
  • Configurable blocked usernames and IP allowlist.
  • All configuration via wp-config.php — no database storage, no admin UI.
  • Logging via error_log() for audit trails.

Installation

  1. Upload the cf-login-guard folder to /wp-content/plugins/.
  2. Add the required constants to wp-config.php (see Configuration below).
  3. Activate the plugin through the WordPress admin.
  4. Create a WAF custom rule in Cloudflare to block IPs on your list.

Configuration

Add the following constants to your wp-config.php, above the line that says "That's all, stop editing!":

Required:

define( 'CFLG_API_TOKEN',  'your-scoped-cloudflare-api-token' );
define( 'CFLG_ACCOUNT_ID', 'your-cloudflare-account-id' );
define( 'CFLG_LIST_ID',    'your-cloudflare-list-id' );

Optional:

// Comma-separated list of usernames to block (default: admin,administrator,root,webmaster)
define( 'CFLG_BLOCKED_USERNAMES', 'admin,administrator,root,webmaster' );

// Comma-separated IPs or CIDR ranges that should never be blocked
define( 'CFLG_ALLOWED_IPS', '203.0.113.10,198.51.100.0/24' );

// Enable logging to PHP error log (default: false)
define( 'CFLG_LOG_ENABLED', true );

Cloudflare API token permissions:

Create an API token at https://dash.cloudflare.com/profile/api-tokens with only the following permission:

  • Account > Account Filter Lists > Edit

Frequently Asked Questions

Does this plugin block traffic directly?

No. The plugin only adds IPs to a Cloudflare list. You must create a WAF custom rule in Cloudflare that references this list to block or challenge the traffic.

What happens if the same IP is added twice?

Cloudflare handles duplicates gracefully. The API call will succeed and the existing entry remains unchanged.

Will this slow down my login page?

The Cloudflare API call adds a small amount of latency (typically under 200ms) to login attempts that use a blocked username. Legitimate login attempts with valid usernames are not affected at all.

Does it support IPv6?

Yes. The plugin validates IPs using PHP's filter_var() with FILTER_VALIDATE_IP, which supports both IPv4 and IPv6. Note that the CIDR allowlist matching currently supports IPv4 only.

Changelog

1.0.0

  • Initial release.