atshiftWordPress Plugins Choose a product Freeform LoginUser Profile Fieldsatshift Membersatshift FieldsKOTOTSUGIatshift DEFTatshift Feed BuilderIP Blocker with WAF
JA

ACCESS CONTROL / FREE

IP Blocker with WAF

Manually block site access
from IP addresses used in attacks.

Read bounded local records from CloudSecure WP Security or Wordfence Security – Firewall, Malware Scan, and Login Security and group exact public IPv4 or IPv6 addresses repeatedly observed under the same classification for review. After an administrator decides an address was used in an attack, previews the change, saves the original file, and confirms independent recovery access, the plugin adds that exact address to its managed section at the beginning of the site-home .htaccess file. Apache 2.4 then rejects HTTP access from that IP before the request reaches WordPress. A candidate is not proof of an attack, and this plugin neither detects attacks nor blocks automatically.

Get it on WordPress.org GitHub View setup

Free / GPLv2 / Apache 2.4 single-site environments

ADMIN REVIEWA person reviews every candidate

APACHE 2.4Rejects access from selected IPs

RECOVERYBackups and site checks

SCROLL

01 / Features

Confirm the target and
recovery path before blocking.

Reviewing WAF records and denying access from selected IPs through .htaccess are separate explicit administrator actions.

01

Read bounded local records

Group repeated observations from CloudSecure WP Security or Wordfence Security by exact IP and classification for administrator review.

02

Preview the configuration change

Review the public IPs to block and the generated .htaccess section, then download the original file before applying.

03

Check the site after applying

Run a self-check after the change and attempt rollback from the saved content when the check fails.

02 / ACCESS CONTROL

Support review and blocking
without replacing the WAF.

This is an administrator tool for reviewing records written by CloudSecure WP Security or Wordfence Security. It does not modify the provider logs.

IP Blocker with WAF key visual
IP Blocker with WAF key visual

03 / Setup

A short path
to getting started.

Before using the plugin on a production site, take a backup and verify the display and behavior in staging.

  1. 1

    Confirm requirements in staging

    Verify Apache 2.4, single-site WordPress, and a site home in the same directory as WordPress.

  2. 2

    Choose a record source and review candidates

    Enable CloudSecure WP Security or Wordfence Security reading, then review classification, count, and IP attribution.

  3. 3

    Review the preview and recovery access

    Save the original file and confirm independent hosting control-panel or SFTP access before applying.

  4. 4

    Block access from selected IPs

    Add only exact public IPs to the managed .htaccess section so Apache 2.4 rejects their HTTP access to the site.

04 / Guides

From setup to daily use,
follow the right guide.

Find the information you need through focused setup, output, and integration guides.

WORDPRESS.ORGOfficial plugin pageFeatures, requirements, and releasesGITHUBSource codeDevelopment and issuesLOG SOURCECloudSecure WP SecuritySupported record sourceLOG SOURCEWordfence Security – Firewall, Malware Scan, and Login SecuritySupported record source

05 / FAQ

Before you install.

Common questions about features, compatibility, and the scope of each plugin.

The block applies to HTTP access sent to the site from exact public IPv4 or IPv6 addresses that an administrator has identified as attack sources. The plugin creates its own conditional-denial section in the site-home .htaccess file, and Apache 2.4 rejects those requests before they reach WordPress.No. A record count or candidate is not proof of an attack. An administrator must review the IP attribution and likely impact.No. Record reading and server editing are separate explicit actions. Applying a block requires selection, preview, and confirmation.It does not independently trust forwarding headers. Use server editing only when Apache client-IP restoration and provider attribution are configured correctly.No. The managed server section and local recovery data remain until an administrator removes them.

WORDPRESS PLUGINS BY @SHIFT

Bring IP Blocker with WAF
into your workflow.

Start in staging and confirm that the plugin fits your actual workflow.

Get it on WordPress.org