=== Whitelist Warden Lite ===
Contributors: mr-tbot
Donate link: https://whitelistwarden.com
Tags: security, firewall, ip whitelist, login security, brute force protection
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Whitelist your trusted IPs, lock out the rest, and stop brute-force logins — a lightweight, fully-functional firewall core for wp-login, wp-admin, and XML-RPC.

== Description ==

**Whitelist Warden Lite** is a focused WordPress firewall: whitelist the IPs you trust, automatically ban the ones that misbehave, and harden the three doors attackers hit first — `wp-login.php`, `/wp-admin/`, and `xmlrpc.php`.

Everything below is included, fully working, forever, at no cost. There is no trial period, no artificial cap on IPs or bans, and no feature that stops working after a quota — this is the complete free core, not a demo of the paid version.

= Core protection (free, forever) =

* **IP Whitelist** — Add trusted IPs and CIDR ranges (your office, your VPN, your team) that Whitelist Warden will never block, even if they trip other rules.
* **Hostile-IP Banning** — Automatically bans IPs that hammer your login form or trigger too many suspicious requests, for a configurable window or permanently.
* **Login Lockdown** — Rate-limits and hardens `wp-login.php` and `/wp-admin/` against brute-force and credential-stuffing attempts.
* **XML-RPC Hardening** — Blocks `xmlrpc.php` pingback abuse and brute-force amplification (the multicall trick), the single most common WordPress attack surface after the login form.
* **.htaccess / Nginx Whitelist Sync** — On Apache, writes and maintains a clearly-marked, safely-scoped block in `.htaccess`. On Nginx, generates an `deny`/`allow` config snippet you include from your server block. Every write is backed up before it's touched.
* **Failed-Login Monitor** — Tracks failed login attempts per IP within a rolling window and applies your ban threshold automatically. Verifies `CF-Connecting-IP` / `X-Forwarded-For` and similar headers against the actual TCP peer before trusting them, so a request that bypasses your CDN can't spoof its way into (or out of) a ban.
* **Admin Dashboard Widget & Ban Manager** — See active bans at a glance from the WP Dashboard; search, unban, or manually ban an IP from a dedicated admin screen.
* **Multisite Compatible** — Works on single-site and multisite installs.

No data leaves your site. Whitelist Warden Lite makes zero external network calls unless you explicitly opt in to a feature that requires one (see the Privacy section below) — it is not a beacon, an analytics client, or a lead-gen funnel.

= Whitelist Warden Pro =

Pro is a separate, paid add-on for sites that want the firewall pushed to the network edge instead of just the origin server, plus real-time alerting:

* **Cloudflare Edge Sync** — Pushes your whitelist and banlist to Cloudflare firewall rules, so traffic is blocked before it ever reaches your server.
* **Notification System** — Email, Discord, Slack, Telegram, and generic webhook alerts for bans, whitelist changes, and sync failures, with severity filtering, digesting, and quiet hours.
* **Extended Dashboard** — Historical charts, log search, and export.
* **DDNS Whitelist** — Auto-resolves and trusts a dynamic-DNS hostname (e.g. a home IP that changes), so a changing home/office IP never has to be whitelisted by hand.
* **Automatic Updates** — Pro updates outside the WordPress.org release cycle, including hotfixes.
* **Priority Support** — Direct email support with a faster response window.

Pro is entirely optional. Whitelist Warden Lite's firewall runs on its own with no dependency on Pro or on any Whitelist Warden service — Pro adds capability, it does not unlock anything Lite is artificially missing. Learn more and see current pricing at [whitelistwarden.com](https://whitelistwarden.com).

= Privacy & external services =

Whitelist Warden Lite does not phone home, does not track usage or send telemetry, and does not call any external API by default. All whitelist, ban, and configuration data is stored in your own WordPress database.

The only network calls Lite ever makes are ones you explicitly configure:

* If you enter a DDNS hostname to whitelist, Lite resolves that hostname via standard DNS lookups (no third-party service involved) — off unless you add a hostname.
* An optional, dismissible admin notice may link to whitelistwarden.com for Pro or documentation. It is shown sparingly, never blocks any screen, and can be turned off.

Whitelist Warden Pro (separate paid plugin) does contact external services you explicitly configure and consent to — the Cloudflare API for edge sync, and whichever notification channels (email/webhook/Discord/Slack/Telegram) you turn on — each gated behind its own opt-in switch and disabled by default. None of that code ships inside Whitelist Warden Lite.

== Installation ==

1. In your WordPress admin, go to **Plugins → Add New** and search for "Whitelist Warden", or upload the plugin ZIP via **Plugins → Add New → Upload Plugin**.
2. Activate **Whitelist Warden Lite**.
3. Go to **Whitelist Warden → Settings** and add your own IP (and any team/office IPs) to the whitelist *before* enabling login lockdown or bans — see "Will this lock me out?" below.
4. Review the default failed-login threshold and window on the **Settings** page and adjust if needed.
5. (Optional) On Apache, confirm your `.htaccess` is writable by the web server user so Whitelist Warden can maintain its block. On Nginx, copy the generated snippet path from **Whitelist Warden → Settings** into your server block and reload Nginx.

= Manual installation =

1. Download the plugin ZIP.
2. Upload the `whitelist-warden-lite` folder to `/wp-content/plugins/`.
3. Activate through the **Plugins** menu in WordPress.

== Frequently Asked Questions ==

= Will this lock me out of my own site? =

It can, like any firewall plugin, if you enable strict lockdown before whitelisting yourself. To avoid this: add your current IP to the whitelist on the **Settings** page first, keep a second admin account or FTP/hosting-panel access handy while you tune the threshold, and check **Whitelist Warden → Logs** immediately after any change. If you do get banned, you (or your host) can remove the Whitelist Warden block from `.htaccess`, or deactivate the plugin via FTP/SFTP/your hosting file manager, to regain access instantly.

= Does it work with Wordfence? =

Yes. Whitelist Warden Lite hooks standard WordPress actions (`wp_login_failed`, `authenticate`) and manages its own clearly-marked `.htaccess` / Nginx block, so it coexists with Wordfence rather than replacing it. Running two brute-force monitors at once is redundant but not harmful; if you already have Wordfence's login protection active, you can disable Whitelist Warden's Login Lockdown on the Settings page and keep just the IP whitelist and XML-RPC hardening.

= Does it work with GhostWP (Hide My WP)? =

Yes. GhostWP/Hide My WP renames and hides `wp-login.php` and `/wp-admin/`; Whitelist Warden Lite reads the *effective* login and admin paths rather than hard-coding the defaults, so its lockdown and whitelist rules apply to your renamed URLs too. If you use a non-default login path, double-check it under **Whitelist Warden → Settings** after activating either plugin.

= Do you need my Cloudflare API token? =

No — not for Lite, ever. Cloudflare edge sync is a Pro-only, opt-in feature. Lite never asks for, stores, or transmits a Cloudflare token, and has no code path that could use one.

= Does this plugin send my data anywhere? =

No, not by default. See the "Privacy & external services" section above — everything is local to your database unless you explicitly turn on a feature (like a DDNS hostname) that requires a network lookup, or you install the separate Pro add-on and opt into its Cloudflare/notification features.

= What happens to my whitelist and bans if I deactivate the plugin? =

Deactivating stops enforcement immediately but keeps your saved whitelist, banlist, and settings in the database. Uninstalling (deleting the plugin from the Plugins screen) removes Whitelist Warden's own data. It does not modify or restore any other plugin's `.htaccess` rules.

= Can I use this on Nginx instead of Apache? =

Yes. Whitelist Warden Lite detects whether it can write `.htaccess` and, on Nginx (or any server where `.htaccess` isn't read), generates an equivalent allow/deny snippet on the Settings page for you to include from your server block, since Nginx doesn't read `.htaccess` files.

= Is Whitelist Warden Lite a crippled trial of Pro? =

No. Every feature listed under "Core protection" above is fully functional with no time limit, no usage cap, and no artificial restriction. Pro adds genuinely separate capability (edge-level sync, alerting, DDNS) rather than unlocking anything held back in Lite.

== Screenshots ==

1. Dashboard overview — active bans, protection status, and recent activity at a glance.
2. IP Whitelist screen — add trusted IPs and CIDR ranges with inline validation.
3. Banned IPs — search, sort, unban, or manually ban an address.
4. Login Lockdown & XML-RPC settings — thresholds, time window, and hardening toggles.
5. WordPress Dashboard widget — ban stats without leaving the main admin screen.

== Changelog ==

= 1.0.0 =
* Initial public release.
* IP whitelist with IPv4, IPv6, and CIDR support.
* Automatic hostile-IP banning with configurable threshold and time window.
* Login Lockdown for `wp-login.php` and `/wp-admin/`.
* XML-RPC hardening (pingback/multicall abuse blocking).
* .htaccess (Apache) and config-snippet (Nginx) whitelist sync with automatic backup before every write.
* Failed-login monitor with spoof-resistant forwarded-header handling.
* Admin dashboard widget and Banned IPs management screen.

== Upgrade Notice ==

= 1.0.0 =
Initial release.
