WhitelistWarden
Your automated V-IP guest list for the modern internet.
Whitelist-Warden reads your server logs in real time and slams the door on attackers
before PHP ever wakes up — at your .htaccess, Nginx, and Cloudflare layer.
Meanwhile it keeps a living whitelist so your team, your CDN, and the crawlers that matter never get caught in the net.
The idea
We're the bouncer at your server's front door.
You wouldn't leave the front door of your business wide open. So why is your login page? Even with strong passwords and 2FA, your admin panels are scanned, fingerprinted and hammered 24/7 by bots.
Whitelist-Warden works like a bouncer with a very short guest list. Trusted devices get waved in. Everyone else waits outside — and the ones that keep knocking get turned away at the lowest level of your stack, before they ever reach WordPress or your database.
- Lower CPU, disk and energy — bad traffic is dropped before PHP runs.
- Cleaner logs — real threats stop drowning in brute-force noise.
- No lost access — DDNS keeps you whitelisted even when your IP changes.
The real problem
Your admin panel is standing wide open.
WordPress, file servers, routers, cameras, dashboards — most ship with admin panels and ports exposed to the whole internet. Attackers don't need to break in. They just keep knocking until something gives.
Every failed login still costs you: CPU and memory burned on junk requests, logs filling with brute-force noise that buries the real threats, and the constant risk of a plugin or service exploit. Whitelist-Warden stops them from finding the door at all.
How it works
Read the logs. Check the list. Shut the door.
Watch
Real-time log intelligence scores every request against four threat categories — probes, forbidden-core hits, plugin scans and catch-all abuse.
Decide
Once an IP crosses your threshold it lands in one banlist — the single source of truth. Trusted IPs, DDNS hosts and CDN ranges are structurally exempt.
Enforce
The banlist is pushed to whatever sits in front of your site — an .htaccess rule, an Nginx deny, or a Cloudflare WAF rule — so it's blocked at the edge.
Sync
The same whitelist flows into Hide My WP / WP Ghost and Wordfence, and Wordfence's own blocks flow back in. One list, everywhere.
See it run
Run it your way — console or WordPress.
A real-time terminal monitor for the server, and a Whitelist-Warden dashboard right inside wp-admin — same engine underneath. A full standalone dashboard is on the way.
// the live Master Monitor TUI — daemon mode
// the WordPress plugin — full dashboard in progress
- Watch bans land the moment a threshold trips.
- Browse bans, tail logs and edit config from wp-admin.
- Or run headless on cron — same engine, no terminal needed.
What's inside
Lean where it counts. Thorough where it matters.
Battle-tested building blocks — .htaccess, Nginx, Cloudflare, DDNS — wrapped in one tailored automation layer. No bloated GUIs, no risky rule builders.
Two execution modes
Cron mode for shared cPanel hosting, or a continuous daemon that tails your logs in real time on a VPS.
Multi-server
Apache & LiteSpeed via .htaccess, Nginx via generated deny/allow configs, reverse-proxy aware — WEB_SERVER=auto detects your stack.
Cloudflare WAF
Manages ALLOW / block / challenge rules across every zone your token can see, with dedup and a static-asset allow clause so good bots skip the challenge.
Dynamic whitelist
Static IPs, DDNS hostnames re-resolved every cycle, and Cloudflare's own edge ranges auto-fetched — so the CDN and your changing home IP are never banned.
WordPress plugin
A companion plugin adds a wp-admin dashboard, ban browser, log viewer and config editors — and syncs the whitelist into Hide My WP & Wordfence.
Safe by design
Hash-checked writes (one per run, not per-ban), timestamped backups, atomic replace, and post-write validation that rolls back on failure.
Notifications
Email & webhook alerts — Discord, Slack or your own endpoint — for bans, whitelist changes, thresholds, sync results and errors, with digests, quiet hours and per-event control.
Real client IP
Resolves the true visitor IP behind Cloudflare and Nginx, and verifies forwarded headers against the peer address so a banned client can't just spoof a clean one.
One config, one script
No confusing rule builders, no sluggish control panels. Lean, hardened, system-level access control — the way it's meant to be.
From the beta
What happened in the first few days.
Numbers from a live beta deployment on our own site — not an independent audit, and your mileage will vary. But the shape was hard to miss.
Complex attacks per day
Before → after · first week of beta
Requests per hour
Day one · junk traffic drained off
The receipts
Straight from the security dashboard.
// Source: our own beta dashboard, Sept 2025. One site, beta conditions, your mileage will vary. Whitelist-Warden complements your WAF — it doesn't replace it.
Who it's for
Built for people who run their own stack.
Small businesses
Protect your admin dashboard and site from botnets — without hiring a security firm.
E-commerce
Reduce risk exposure around checkout and customer data with edge-level access control.
IT consultants / MSPs
Maintain a client's allowlist from one central point and add it to your service offering.
Home office / NAS
Gate your admin panels, cameras and smart-home dashboards behind a whitelist.
Web developers
Lock down staging and dev dashboards so they're invisible to everyone but you.
Home labs
The same allowlist model built to extend beyond WordPress as the project grows.
60 seconds
Meet the warden.
Free core
Download Whitelist-Warden Core — free.
The full free core: the WordPress plugin and the server toolkit, plus the setup guide. No account, no trial timer — free forever.
- IP whitelist, hostile-IP banning, login & wp-admin lockdown.
- .htaccess / Nginx allow & deny sync, plus a failed-login monitor.
- Works with Wordfence & WP Ghost out of the box.
Complete package — WordPress plugin + server toolkit + setup guide (.zip).
WordPress plugin only (.zip)Want Cloudflare edge sync, notifications, a live dashboard & auto-updates? Go Pro — 7-day free trial.
Questions
Before you ask.
Do I need root access?
No. It runs in your own cPanel/shell account. The shell toolkit needs SSH or cron on a host you control; the companion plugin runs inside WordPress.
Does it replace Cloudflare or Wordfence?
No — it works with them. It feeds your Cloudflare WAF and Wordfence allowlists and can pull Wordfence blocks back into its own banlist. It's the bouncer, not the whole wall.
Will it block my real visitors or Google?
It's built to minimise false positives: trusted IPs, DDNS hosts and your CDN's edge ranges stay on a dynamic whitelist. We tune the thresholds so legit crawlers stay out of the net.
Is there a free version?
Yes — the Core (WordPress plugin + server toolkit) is free forever. Pro adds Cloudflare edge sync, notifications, a live dashboard, DDNS whitelist and auto-updates for \$10/mo or \$99/yr, with a 7-day free trial.