=== Witen Blocker — AI Crawler Control, Login Lockout & 2FA ===
Contributors: witenlabs
Tags: ai crawlers, gptbot, bot blocker, limit login attempts, ip blocklist
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 8.1
Stable tag: 0.6.51
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Allow or block GPTBot, ClaudeBot, and every other AI crawler, one by one. Lock out password guessers, add 2FA, and stop comment spam. Free.

== Description ==

You decide who gets into your WordPress site. Choose which AI crawlers can read your content, lock out bots guessing your password, and stop comment spam. Protection starts the moment you activate it, with no account and no setup wizard.

= Choose which AI crawlers read your site =

Every recognized crawler gets its own allow or block switch. Welcome every AI crawler, block them all, or pick one by one. Nothing is blocked until you choose.

Witen Blocker recognizes GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Common Crawl, Meta-ExternalAgent, Amazonbot, and Applebot, plus the major search engines and ten uptime monitors, so a rule for one bot never catches the services you rely on.

robots.txt states your preference; Witen Blocker enforces it. A crawler you block gets an HTTP 403. Crawlers are matched by their published network ranges as well as their user agent, so a scraper pretending to be Googlebot doesn't get Googlebot's pass.

= Lock out password guessers =

Five failed logins in five minutes locks the address out for an hour, and you can change all three numbers. Add two-factor sign-in with any authenticator app and printable recovery codes, so a stolen password alone no longer opens your dashboard. Move the login page to an address only you know.

= Block known WordPress exploits =

Template traversal and comment exploit requests are refused before they reach the vulnerable WordPress code. No account needed.

= Stop comment spam without a spam service =

A hidden field and a timing check catch bots. No comment text ever leaves your site.

= Catch unexpected file changes =

A daily scan checks WordPress core against the official checksums, flags new and changed files, and looks for known malware patterns. Nothing is deleted or changed without you. Connected sites also receive maintained malware catalogs.

= Block attackers before they reach you =

Connect a free Witen account and your site gets blocklists built from attacks seen across every Witen site and server. An address caught attacking other sites is blocked on yours before it tries. Requests are checked against a local copy of the list, so no page load waits on Witen.

Connecting requires a Witen account and security-event sharing. Every local feature stays free, with no trial expiry. Free connected sites get a daily blocklist update. Paid plans add more sites and servers, other feed profiles, and off-site backup storage.

= Shared hosting or your own server =

On shared hosting, blocked requests get an HTTP 403 from WordPress, with no server access needed. On your own Linux server, add the Witen Warden agent and blocks move to the firewall, before the traffic ever reaches PHP.

**Get started:** activate Witen Blocker and open **Witen > Dashboard** to see what's already on. Use **Firewall > Bots and AI crawlers** to choose which crawlers can visit, and **Login** to set up two-factor sign-in.

[Setup guide](https://www.witenlabs.com/docs/wordpress) | [Witen plans](https://www.witenlabs.com/pricing) | [Support](https://wordpress.org/support/plugin/witen-blocker/)

== Installation ==

1. Open **Plugins > Add New Plugin**, search for **Witen Blocker**, and install and activate it. You can also upload the plugin ZIP.
2. Open **Witen > Firewall** and add your own IP address to the never-block list. Then choose which bots and AI crawlers to allow.
3. Open **Witen > Login** to set up two-factor sign-in for your account.
4. Optional: to add shared blocklists, create a [Witen account](https://www.witenlabs.com), add your WordPress site from the dashboard, and enter its one-time setup token in **Witen > Settings**. Review the terms and privacy information before connecting. The first blocklist arrives after background maintenance runs.

See the [setup guide](https://www.witenlabs.com/docs/wordpress) to connect a local Warden agent or configure your site through wp-config.php.

== Frequently Asked Questions ==

= How is this different from robots.txt? =

robots.txt states your preference, and crawlers that honor it follow it. Witen Blocker enforces your choice: a crawler you block gets an HTTP 403, and a crawler you allow passes. Use both if you like.

= What can I use without an account? =

Everything local: AI crawler and bot controls, login lockout, two-factor sign-in, comment spam checks, exploit blocks, file and malware scans, and the .htaccess editor. A Witen account adds shared blocklists and reporting.

= Will it slow down my site? =

No. Request checks use local data and never wait on a remote service. Blocklist updates, reporting, and scans run in background jobs.

= Can I use it alongside another security plugin? =

Yes. If both plugins handle two-factor, login limits, bot rules, or .htaccess, turn each feature on in one plugin only, then test your login.

= How do I change login limits or recover from a lockout? =

Open **Witen > Login > Login lockout** to set the failure window, failure count, and ban duration. Defaults are 5 failures in 5 minutes and a 1-hour ban. Saved settings override `WITEN_LOGIN_WINDOW_SEC`, `WITEN_LOGIN_MAX_FAILURES`, and `WITEN_LOGIN_BAN_SEC` in wp-config.php.

Keep your 2FA recovery codes. If you lock yourself out, wait for the ban to expire or follow the [recovery guide](https://www.witenlabs.com/docs/lockout), which covers WP-CLI and SFTP. Deactivating the plugin leaves existing .htaccess and Warden firewall rules in place; the guide shows how to remove them.

= Does a scan finding mean my site is hacked? =

No. A finding is a file worth a look, and legitimate customizations can trigger one. Witen Blocker shows you which files to check. It doesn't clean an infected site for you.

= What happens if Witen is unavailable? =

Your site stays protected. Local protection keeps running, cached blocklists stay in use until they expire, and reports queue and retry in the background. Sites that report through a local Warden agent wait for Warden rather than reporting to Witen directly.

= Does it support multisite? =

Yes. Each site has its own settings, connection, logs, and jobs. The main site's network administrator controls the shared .htaccess, and user accounts and two-factor setup are network-wide. If you use a local Warden agent, connect each site separately.

== External Services ==

= Witen Collector =

Connected features use `https://collector.witenlabs.com`. Enrollment exchanges your setup token and installation identity for a credential. Witen processes shared reports to identify distributed attacks and provide threat intelligence.

Background sync sends events and site details (listed below) and retrieves blocklists, bot identities, signed malware catalogs, Tor exit nodes, allowlists, service status, network statistics, and feed profiles. Profile changes send your selection and site identifier; IP lookups send the queried address. Block reports include the IP, rule, outcome, request context, and site identifier.

* **Malware samples:** off by default. Setting `WITEN_SEND_MALWARE_SAMPLES` to boolean `true` in `wp-config.php` permits file-content uploads. Scans do not require them.
* **Off-site .htaccess backups:** off by default. Enabling them permits encrypted file uploads, with checksum and size, and dashboard-requested restores. Witen can decrypt the files and keeps 10 versions. Restores validate content, make a local backup, and report results. Disabling the option stops uploads and remote restores; local backups remain available.

[Witen terms](https://witenlabs.com/terms) | [Witen privacy policy](https://witenlabs.com/privacy)

`WITEN_COLLECTOR_URL` selects another collector if you operate one; its operator's policies apply. Explicitly configuring `WITEN_SOCKET_PATH` authorizes sharing with local Warden, whose configuration controls onward delivery. Detecting a socket alone does not enable sharing.

= Cloudflare proxy ranges =

Enrolled sites refresh `https://www.cloudflare.com/ips-v4/` and `https://www.cloudflare.com/ips-v6/` during background maintenance to recognize trusted proxies. Offline sites use bundled ranges. Requests send ordinary HTTPS network metadata, not WordPress visitor events or account data.

[Cloudflare terms](https://www.cloudflare.com/website-terms/) | [Cloudflare privacy policy](https://www.cloudflare.com/privacypolicy/)

= WordPress.org core checksums =

Integrity scans request official hashes from `https://api.wordpress.org/core/checksums/1.0/`, sending your WordPress version, locale, and ordinary HTTPS network metadata. No visitor events, account data, or site content is sent.

[WordPress.org privacy policy](https://wordpress.org/about/privacy/)

The plugin does not remotely load executable code or frontend assets. Bundled bot references cause no remote requests or crawler DNS lookups. Collector connections use your DNS resolver. Background jobs and Apache rule checks call your own WordPress URLs.

== Privacy Policy ==

Events stay local until enrollment or explicit Warden socket configuration. Earlier events are never uploaded retroactively. Connected intelligence requires event sharing. Deactivate the plugin to stop reporting from WordPress; a separately running Warden keeps its own reporting configuration.

**What is shared:** IP addresses; successful and failed logins; XML-RPC, comment, registration, and 404 events; request URLs, methods, User-Agent strings, referrers, and query information; and attempted usernames, which may be email addresses. Installation reports include site name and URL, WordPress/PHP/plugin versions, and a random installation identifier. An observed IP is not necessarily an attacker. Reports help identify distributed attacks, relate failed logins to later successful ones, and maintain blocklists.

Event reports exclude form bodies, post content, comment text, password fields, cookies, and session data. URLs and metadata can contain personal data. File samples and .htaccess backups are separate options, described above. `WITEN_NO_TELEMETRY` stops daily installation reports, but not connected security-event sharing.

**Local storage:** the delivery queue holds up to 500 events for seven days. Witen also keeps the latest 100 dashboard events and blocks, block and allow lists, and health counters. Rejected events and block-decision reports have separate diagnostic queues, each limited to 100 records or 1 MiB. Older records are removed at the limit; diagnostics otherwise remain until uninstall.

Deactivation preserves settings and existing .htaccess and Warden firewall rules. Uninstall removes Witen options, transients, scheduled actions, and database tables. Collector retention follows its operator's privacy policy; request collector-side deletion from that operator.

== Screenshots ==

1. Protection active on an unconnected WordPress installation, with optional two-factor, crawler, and account setup.
2. Per-crawler AI policies: choose which recognized crawlers are allowed or blocked.
3. Login limits, two-factor setup links, and a custom login address in one place.
4. File integrity and malware scan controls, with unscanned state shown accurately.

Screenshots use an isolated test installation with demonstration accounts, not customer data.

== Changelog ==

= 0.6.51 =
* Enter your password and optional authenticator or recovery code together on the login form. A valid password awaiting a two-factor code no longer generates failure reports, audit entries, or login lockouts.
* Show the authenticator QR code, secret, and eight recovery codes during setup. Enable two-factor authentication only after confirming a working authenticator code and saving the recovery codes.
* Require your current password and an authenticator or recovery code before disabling two-factor authentication, revealing its secret, or generating new recovery codes. Administrators must verify their own identity before resetting another user.
* Stop bundled background queue dispatch during deactivation and uninstall, before plugin files are removed.
* Open the Spam folder from the dashboard count and explain that it records comments Witen marked over time.
* Resolve visitor addresses through Witen SDK 1.6. Cloudflare edges that arrive as IPv4-mapped IPv6 addresses are no longer counted or banned as visitors.
* Never ban CDN edge addresses or send them for enforcement. Failed logins through an edge are still recorded.
* Attribute Cloudflare Worker traffic to its Worker zone, so one Worker cannot get a shared Cloudflare address banned.
* Report spoofed client-IP headers by header name only. Header values are never sent.
* Replace the setting that trusted proxy headers from any sender with Trusted proxies in Settings. Visitor headers are read only from published CDN ranges or proxies you list. Existing setups migrate on upgrade, and a notice asks for your proxy's addresses when one is needed.
* Name your own Cloudflare Worker zones, so requests from your Workers keep the real visitor address.

= 0.6.50 =
* Allow Starter and Growth plans to select global and SSH threat feeds consistently in settings and service synchronization.
* Keep hidden Firewall pages accessible through WordPress's native authorization checks.
* Group controls into Dashboard, Firewall, Login, Scan, and Settings while keeping existing page links working.
* Guide first-time activations to local protection and optional setup, with connection details in expandable diagnostics.
* Show the two-factor field only after password verification for accounts using it. Passwords are never retained between attempts.
* Translate more admin labels and show unscanned file integrity accurately.
* Make login limits editable on production sites and apply wp-config.php login constants consistently.
* Show active local protection and bundled bot identities without requiring an account.
* Add Settings and recovery links, a deactivation warning, and a warning for unverified proxy addresses.

See `changelog.txt` in the download for older releases.

== Upgrade Notice ==

= 0.6.51 =
Set up 2FA in your profile, save recovery codes, and confirm your authenticator. Existing 2FA settings stay intact. Review Trusted proxies in Settings: headers are trusted only from published CDN ranges or proxies you list. Add your proxy's addresses if you relied on X-Real-IP.
