Title: SentraIP
Author: moveforwardltd
Published: <strong>سپتمبر 10, 2026</strong>
Last modified: سپتمبر 10, 2026

---

Search plugins

![](https://ps.w.org/sentraip/assets/banner-772x250.png?rev=3690553)

![](https://ps.w.org/sentraip/assets/icon-256x256.png?rev=3690553)

# SentraIP

 By [moveforwardltd](https://profiles.wordpress.org/moveforwardltd/)

[Download](https://downloads.wordpress.org/plugin/sentraip.1.1.6.zip)

 * [Details](https://ps.wordpress.org/plugins/sentraip/#description)
 * [Reviews](https://ps.wordpress.org/plugins/sentraip/#reviews)
 *  [Installation](https://ps.wordpress.org/plugins/sentraip/#installation)
 * [Development](https://ps.wordpress.org/plugins/sentraip/#developers)

 [Support](https://wordpress.org/support/plugin/sentraip/)

## Description

SentraIP filters unwanted visitors before they reach your WordPress application 
layer. Blocking runs on the WordPress `init` hook, before your theme and most plugins
load, and every lookup is performed locally against offline MMDB database files 
in your uploads directory — so no external request is made on normal page loads.

The plugin is free and open source (GPLv2 or later), maintained by Move Forward 
Limited. It works out of the box and **no account and no paid plan is ever required**
to use it.

#### What it blocks

 * **Country (geolocation) blocking** — block visitors by country. You download 
   a free IP-to-country database from a provider of your choice (DB-IP, MaxMind 
   GeoLite2 or IP2Location LITE); your own admin country and your server’s country
   are excluded automatically so you never lock yourself out.
 * **Bot blocking** — block well-known crawlers, scanners and attack tools (Googlebot,
   GPTBot, SemrushBot, AhrefsBot, ClaudeBot and many more) by User-Agent. Requests
   with an empty or missing User-Agent can also be blocked.
 * **Spam-comment IP blocking** — IPs from comments marked as spam (manually, by
   bulk action, or by Akismet) are blocked automatically for 24 hours. This needs
   no external data at all.
 * **Free SPAM reputation dataset (opt-in)** — optionally download a free SPAM IP
   reputation database to block known spam sources. Entirely opt-in, no account 
   required.
 * **IP whitelist** — approved IPs and CIDR ranges are never blocked, so you can
   always guarantee your own access.
 * **Statistics & Blockable Traffic insights** — see what was blocked over time,
   and see allowed traffic that matched a dataset so you can decide what to start
   filtering.
 * **Blocker Simulator** — test what the blocker would do for any IP / User-Agent,
   without blocking anything.
 * **Configurable response** — return 403, 404, 410, 444 or 503 for blocked requests.
 * **Proxy-aware** — behind Cloudflare or a reverse proxy, enable “Trust Proxy Headers”
   so the real visitor IP is used for every check.
 * **Lockout-safe by design** — the WordPress admin (`/wp-admin`), `/wp-login.php`
   and `/wp-register.php` are never blocked, logged-in users are never blocked, 
   and an emergency kill switch (`WP_SENTRAIP_DISABLE_BLOCKING`) can disable all
   blocking from `wp-config.php`.
 * **Secure storage** — database files live in a protected uploads subdirectory 
   guarded by `.htaccess` and `index.php`.

#### Advanced datasets (optional add-on)

Additional IP-reputation datasets — VPN, TOR, PROXY, THREAT and Datacenter blocking,
per-provider VPN blocklists, and composed AND/OR rules — are available through a
separate companion plugin, **SentraIP PRO**, which connects to a SentraIP account.
This free plugin is fully functional on its own and never requires the add-on. See
https://sentraip.com for details.

#### How it works

Choose a geolocation provider on the **Geolocation** page and download the country
database (a monthly WordPress cron keeps it fresh). Configure your rules under **
Countries**, **Bots** and **Settings  Blocking Controls**. Every request is then
checked locally against the offline database files — there is no per-request external
call.

### External services

To keep visitor lookups fast and offline, this plugin downloads database files from
a few third-party services. Understanding which services are contacted, and what
data is sent, is important for your privacy and legal compliance. No external request
is made on normal visitor page loads — only when a database is downloaded or refreshed,
and only for the features you opt into.

**Free SPAM dataset (opt-in, no account required)**

The free version can download a SentraIP SPAM reputation database to block known
spam sources. This is entirely opt-in and needs no API token or account.

 * **What it is used for:** downloading and monthly refreshing the free SPAM MMDB
   database used for blocking.
 * **When data is sent:** only after you enable the free SPAM dataset on the **SentraIP
   Settings** page. Nothing is downloaded on activation or without your consent,
   and no request is made on normal visitor page loads.
 * **What data is sent:** your site host name and a public key generated for your
   installation (used to authorise the download). The plugin generates a key pair
   locally, registers only the public key with SentraIP (`app.sentraip.com`), and
   signs each download request; the private key never leaves your server. No visitor
   IP address or personal data is sent.
 * **If you do not enable it:** SPAM blocking still works — IP addresses from comments
   you mark as spam are blocked automatically, with no external request. The dataset
   is an optional enhancement, not a requirement.
 * **Service site / terms:** https://sentraip.com
 * **Privacy policy:** https://www.mforward.eu/privacy-policy/ (Terms: https://sentraip.
   com/plugin-terms-of-service/)

**Sharing spam-comment IPs with SentraIP (opt-in, off by default)**

You can optionally let SentraIP collect the IP addresses of comments you mark as
spam, to help improve protection for every site using SentraIP.

 * **What it is used for:** contributing your spam-comment IPs to SentraIP’s shared
   reputation data.
 * **When data is sent:** only after you tick **Share spam IPs with SentraIP** on
   the **SentraIP  Settings** page. It is off by default; with the box unticked 
   nothing is ever shared and the feed endpoint refuses all requests.
 * **What data is sent:** only the IP addresses recorded from comments you marked
   as spam (a ~15-day window). No comment content, author names, e-mails or other
   personal data are sent. SentraIP reads the list over an authenticated request
   signed with its own key; your site verifies that signature before responding.
 * **If you do not enable it:** spam-comment IP blocking still works locally on 
   your site exactly as before — this option only governs sharing.
 * **Service site / terms:** https://sentraip.com
 * **Privacy policy:** https://www.mforward.eu/privacy-policy/ (Terms: https://sentraip.
   com/plugin-terms-of-service/)

**Geolocation database providers (opt-in)**

Country blocking needs an IP geolocation database, which you download from one free
third-party provider that you choose on the **SentraIP  Geolocation** page. No provider
is selected by default and no geolocation download happens until you explicitly 
opt in by choosing one. Once a provider is configured, its database is also refreshed
automatically once a month by a WordPress cron job. The database is queried locally
on your server; no visitor data is sent to these providers at request time.

 * **DB-IP** (https://db-ip.com) — recommended, no registration. Downloads from `
   download.db-ip.com`. No credential is sent. Terms: https://db-ip.com/tos.php
 * **MaxMind GeoLite2** (https://www.maxmind.com) — requires a free account. Downloads
   from `download.maxmind.com`; your MaxMind license key is sent to authenticate
   the download. Privacy: https://www.maxmind.com/en/privacy-policy
 * **IP2Location LITE** (https://lite.ip2location.com) — requires a free account.
   Downloads from `www.ip2location.com`; your IP2Location download token is sent
   to authenticate the download. Terms: https://www.ip2location.com/terms

See the attribution notes below for the data licences of each provider.

### Attributions

Depending on the geolocation provider you choose, this product includes data that
requires attribution:

 * DB-IP: IP Geolocation by DB-IP (https://db-ip.com), licensed under CC-BY 4.0.
 * MaxMind: This product includes GeoLite2 data created by MaxMind, available from
   https://www.maxmind.com.
 * IP2Location: This product uses IP2Location LITE data available from https://lite.
   ip2location.com.

The bundled MaxMind DB reader library is distributed under the Apache License 2.0.

The admin charts are drawn by a small self-contained SVG renderer bundled with the
plugin (admin/js/wp-sentraip-charts.js) — no third-party JavaScript charting library
is used.

## Screenshots

[⌊Dashboard — blocked and blockable traffic charts and the blocker simulator.⌉⌊Dashboard—
blocked and blockable traffic charts and the blocker simulator.⌉[

Dashboard — blocked and blockable traffic charts and the blocker simulator.

[⌊Statistics — total blocked traffic over time and a breakdown by type.⌉⌊Statistics—
total blocked traffic over time and a breakdown by type.⌉[

Statistics — total blocked traffic over time and a breakdown by type.

[⌊Blockable Traffic — traffic that was allowed through but matches a dataset you
could block, with per-category counters and top-10 tables.⌉⌊Blockable Traffic — 
traffic that was allowed through but matches a dataset you could block, with per-
category counters and top-10 tables.⌉[

Blockable Traffic — traffic that was allowed through but matches a dataset you could
block, with per-category counters and top-10 tables.

[⌊Countries — block visitors by country, grouped by continent; your own country 
is always excluded.⌉⌊Countries — block visitors by country, grouped by continent;
your own country is always excluded.⌉[

Countries — block visitors by country, grouped by continent; your own country is
always excluded.

[⌊Bots — block well-known crawlers, scanners and attack tools by User-Agent.⌉⌊Bots—
block well-known crawlers, scanners and attack tools by User-Agent.⌉[

Bots — block well-known crawlers, scanners and attack tools by User-Agent.

[⌊Geolocation database — choose a free IP-to-country provider (DB-IP, MaxMind or
IP2Location) and download it locally.⌉⌊Geolocation database — choose a free IP-to-
country provider (DB-IP, MaxMind or IP2Location) and download it locally.⌉[

Geolocation database — choose a free IP-to-country provider (DB-IP, MaxMind or IP2Location)
and download it locally.

[⌊Settings — master on/off switches per category, response code, proxy headers, 
IP whitelist and emergency recovery.⌉⌊Settings — master on/off switches per category,
response code, proxy headers, IP whitelist and emergency recovery.⌉[

Settings — master on/off switches per category, response code, proxy headers, IP
whitelist and emergency recovery.

## Installation

 1. In your WordPress admin go to **Plugins  Add New  Upload Plugin**.
 2. Choose the `sentraip.zip` file and click **Install Now**, then **Activate**.
 3. Open **SentraIP  Geolocation**, choose a free IP-to-country provider (DB-IP needs
    no account) and download the database.
 4. Configure your blocking rules under **Countries** and **Bots**, and the master 
    switches under **Settings  Blocking Controls**.
 5. (Optional) On **SentraIP  Settings**, enable the free SPAM reputation dataset.

Manual installation: extract the `sentraip` folder into `/wp-content/plugins/` and
activate it from the **Plugins** menu.

Requirements: PHP 7.4+ and WordPress 6.8+. IP lookups use the MaxMind DB reader,
which is bundled with the plugin.

## FAQ

### Is the plugin free? Do I need an account?

The plugin is free and open source (GPLv2 or later) and fully functional on its 
own. Country blocking, bot blocking (with a large built-in list), automatic spam-
comment IP blocking, the IP whitelist and the opt-in free SPAM reputation dataset
all work with **no account at all**. Additional IP-reputation datasets (VPN, TOR,
PROXY, THREAT, Datacenter and composed rules) are available through the separate**
SentraIP PRO** companion plugin, which connects to a SentraIP account — but this
free plugin never requires it.

### Will this block my own access?

No. The plugin auto-excludes your server’s country and your saved admin country.
The WordPress admin area, the login page (`/wp-login.php`) and the registration 
page are never blocked, and logged-in users are never blocked — so you can always
sign in and fix a rule. As a last resort you can add `define( 'WP_SENTRAIP_DISABLE_BLOCKING',
true );` to `wp-config.php` to disable all blocking.

### What happens if the database files are not downloaded yet?

The plugin gracefully skips any check whose database file is missing. Your site 
keeps working normally until the files are available.

### Does the plugin make external requests on every page load?

No. All IP lookups run against local binary database files in your uploads directory.
External connections are made only when downloading or refreshing a database file(
on a monthly schedule, or when you trigger it manually) — the geolocation database,
or the opt-in free SPAM dataset.

### Where are the database files stored?

In `wp-content/uploads/wp-sentraip/`. The directory is protected by a `.htaccess`(`
Deny from all`) and an `index.php` to prevent direct web access.

### Does it support IPv6?

Yes. The plugin detects whether the visitor’s IP is IPv4 or IPv6 and uses the matching
database file, when that version is available for the dataset.

### What is the spam comment IP blocking?

When a comment is marked as spam, the commenter’s IP is recorded and blocked for
24 hours. This works entirely locally, with no external data or account.

### How do I recover if a rule locks me out?

Open `/wp-login.php` and sign in — login and `/wp-admin` are never blocked. Then
edit the rule that caught you and remove your country/datacenter/IP. If you cannot
reach the admin at all, add `define( 'WP_SENTRAIP_DISABLE_BLOCKING', true );` to`
wp-config.php`.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“SentraIP” is open source software. The following people have contributed to this
plugin.

Contributors

 *   [ moveforwardltd ](https://profiles.wordpress.org/moveforwardltd/)

[Translate “SentraIP” into your language.](https://translate.wordpress.org/projects/wp-plugins/sentraip)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/sentraip/), check out
the [SVN repository](https://plugins.svn.wordpress.org/sentraip/), or subscribe 
to the [development log](https://plugins.trac.wordpress.org/log/sentraip/) by [RSS](https://plugins.trac.wordpress.org/log/sentraip/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.1.6

 * All statistics features now work for everyone: the configurable retention, the“
   Clear all statistics” reset, the full CSV export and the high-rate non-blocked
   traffic view are no longer restricted — they record and run locally on your own
   site, so they are part of the free plugin.
 * Fixed the Privacy Policy and Terms links and the third-party provider links in
   the readme, which pointed to pages that returned a 404.
 * SentraIP can now reliably read the spam-comment IP feed even if its own address
   happens to be on the site’s blocklist: requests genuinely signed by SentraIP (
   Ed25519, verified against a public key fetched from the service and cached) bypass
   the block and authorise the feed endpoint. Works with or without a SentraIP account.
 * Added an explicit opt-in (Settings  Security) to share the IPs of comments you
   mark as spam with SentraIP to improve protection for everyone. It is off by default;
   with it disabled nothing is shared and the feed endpoint refuses all requests.

#### 1.1.4

 * Statistics: the Blockable-Traffic timeline query now passes its LIKE pattern 
   through a bound parameter (esc_like), completing the prepared-SQL hardening. 
   No functional change.

#### 1.1.3

 * Statistics queries now use $wpdb->prepare() with the %i identifier placeholder
   for table names, fully parameterising every custom query (WordPress.org prepared-
   SQL compliance). No functional change.

#### 1.1.2

 * WordPress.org coding-standards compliance: replaced discouraged filesystem calls
   with the WordPress APIs (wp_delete_file(), WP_Filesystem::move()), replaced mt_rand()
   with wp_rand(), sanitized all request input inline, prefixed uninstall globals,
   and audited the statistics table queries. No functional change.

#### 1.1.1

 * Fixed the Statistics hourly drill-down (click a day bar) always showing “No data”:
   the hourly rows were matched against formatted “HH:00” labels instead of the 
   raw hour numbers stored in the database, so no bar was ever drawn.
 * The daily chart/insights cache is now fully cleared on update (including the 
   per-day drill-down entries), so a plugin update never serves data built by the
   previous version.
 * Tested up to WordPress 7.1.

#### 1.1.0

 * SentraIP is now a standalone free plugin: it blocks by country, known bots and
   custom User-Agent strings, spam-comment IPs (24h), and an opt-in free SPAM reputation
   dataset — no account required. The paid datasets (VPN, TOR, PROXY, THREAT, Datacenter
   and composed rules) moved to the separate SentraIP PRO add-on.
 * Free SPAM dataset: the download now succeeds when the IPv4 file is fetched (the
   dataset is published as IPv4-only); a missing per-version file is treated as “
   not published yet” instead of an error.
 * Rebuilt the blocking pipeline around an extension architecture: each block type
   is a self-contained extension evaluated by a collect-all pipeline.
 * The IP whitelist (approved IPs/ranges are never blocked) is now available to 
   everyone.
 * Scheduled tasks are reconciled automatically after an in-place update — no need
   to deactivate/reactivate the plugin to pick up newly added cron jobs.
 * Added a link to sentraip.com on the Dashboard and Settings pages so you can discover
   the optional SentraIP PRO add-on (shown only when PRO is not installed).
 * Replaced the bundled Chart.js library with a small self-contained SVG chart renderer,
   removing a large minified third-party bundle from the plugin.

#### 1.0.25

 * Fixed ULTRA plan being treated as a lesser tier for advanced statistics: since
   ULTRA includes everything in PRO, ULTRA accounts now correctly get the granular(
   hourly + rate) statistics, the retention settings, the reset action, the full
   data export and the enhanced continent/region/city country view — previously 
   these were shown only to PRO and ULTRA users were downgraded to the free view.
   The statistics export now also reports the actual plan name.
 * Replaced all direct cURL calls in the plugin’s own code with the WordPress HTTP
   API (wp_remote_get) for dataset downloads, resolve probes and the geolocation
   database download.
 * Moved the remaining inline admin `<script>` (Ultra rules data) to wp_add_inline_script().
 * Hardened IP whitelist validation: CIDR prefix lengths are now checked against
   the address family (/32 max for IPv4, /128 max for IPv6), so invalid ranges such
   as 192.0.2.1/64 are rejected.
 * Removed the explicit load_plugin_textdomain() call; WordPress loads plugin translations
   automatically.
 * Translation files (.po/.mo) are no longer bundled — translations are delivered
   via translate.wordpress.org; only the .pot template ships for translators.
 * Updated the bundled Chart.js library to 4.5.1.

#### 1.0.24

 * Fixed Datacenter blocking: the whitelist is now honoured. When Datacenter blocking
   is enabled in Settings, datacenter IPs are blocked unless their provider name
   is on the Datacenter whitelist (or belongs to the server’s own datacenter). The
   check now reads the “full” datacenter dataset (v4 and v6 when installed) as the
   single source of truth for both membership and the provider name — so the blocker
   and the dashboard Blocker Simulator behave identically. Previously the name was
   read from the flag-only “light” file, so the whitelist never matched and every
   datacenter IP was blocked.
 * Fixed inconsistent Datacenter blocking between IPv4 and IPv6: when a datacenter
   IP’s provider name cannot be resolved (e.g. an IPv6 address with no “full” IPv6
   dataset), the whitelist cannot be applied, so the request is now allowed instead
   of being silently blocked. This makes IPv6 behave like IPv4 for whitelisted providers.
 * The downloader now also fetches the “full” IPv6 datasets for VPN and Datacenter
   when the SentraIP API publishes them, so provider/datacenter names can be resolved
   for IPv6 clients and the whitelist works fully on IPv6. Previously only the “
   full” IPv4 file was downloaded.
 * Compliance with the WordPress.org Plugin Directory guidelines:
 * Renamed the plugin to “SentraIP” (text domain “sentraip”) so the name and directory
   slug no longer begin with the reserved term “wp”.
 * Documented the freemium model: the plugin is GPL and free; TOR and SPAM datasets
   are available on the free SentraIP account, other datasets on paid plans. The
   free account now grants the TOR and SPAM datasets by default.
 * Removed the duplicate TOR/SPAM/PROXY/THREAT toggles from the Rules page; these
   are managed under Settings  Blocking Controls.
 * Added leakix, the l9 scanner family and many other scanner/attack tool signatures
   to the default bot list.
 * Chart.js is now bundled with the plugin and served locally instead of being loaded
   from an external CDN.
 * Geolocation is now fully opt-in: no provider is selected by default and no third-
   party geolocation database is downloaded until you choose a provider on the Geolocation
   page.
 * Expanded the “External services” documentation: geolocation download hosts (DB-
   IP, MaxMind, IP2Location), when they are contacted, and which credentials are
   sent; documented the optional spam-IP REST feed.
 * Added Apache-2.0 licence notices to the bundled MaxMind DB reader files.
 * Trimmed the bundled MaxMind reader to the pure-PHP library actually used at runtime:
   the build now excludes the native C extension source, its .phpt tests and package
   metadata (no development tools shipped), while keeping all required LICENSE/NOTICE
   files.
 * Fixed the STARTER plan to grant TOR, SPAM and PROXY, matching the official SentraIP
   plans.
 * Updated “Requires at least” (6.8) and “Tested up to” (7.0).

#### 1.0.23

 * Fixed the VPN and Datacenter provider lists, which were empty: provider/datacenter
   names live only in the `full` dataset (fields vpn_provider / organization), while
   the `light` file used for blocking carries just a membership flag. The plugin
   now downloads the `full` v4 file for VPN and Datacenter and enumerates names 
   from it (IPv4 only).

#### 1.0.22

 * Added the required readme.txt and a full GPLv2 LICENSE file for the WordPress.
   org Plugin Directory.
 * Hardened output escaping across admin pages and switched uninstall queries to
   prepared statements.
 * Namespaced cache keys (transients) and completed cron cleanup on uninstall.
 * Removed unused admin pages and their dead handlers/assets.

#### 1.0.21

 * Dataset-driven architecture: blocking and configuration pages now follow the 
   datasets your token grants, not the plan name.
 * Retention by entitlement: installed database files for granted datasets are never
   deleted when a listing is empty or partial.
 * Downloader reads available IP versions (`ip_versions`) and only fetches files
   that exist.
 * Configurable retention (7–90 days, default 30) for Blockable Traffic data.
 * Settings: removed the “External Services” and “SentraIP API” boxes.
 * Recovery: `/wp-admin`, `/wp-login.php` and `/wp-register.php` are never blocked,
   even when your IP is in a blocklist; the site frontend stays protected.
 * Updated Italian, Spanish, French and German translations.

#### 1.0.9

 * Blockable Traffic (Insights) page, Blocker Simulator, recovery section and translations.

#### 1.0.2

 * Spam comment IP collector — blocks IPs from spam comments for 24 hours.
 * REST debug endpoint for testing the blocking pipeline.
 * Bot check now blocks requests with empty or missing User-Agent.

#### 1.0.0

 * Initial release: country and bot blocking, reputation datasets, VPN/Datacenter
   blocking, composed rules, statistics dashboard and internationalization.

## Meta

 *  Version **1.1.6**
 *  Last updated **2 ورځې ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.8 or higher **
 *  Tested up to **7.1**
 *  PHP version ** 7.4 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/sentraip/)
 * Tags
 * [bot protection](https://ps.wordpress.org/plugins/tags/bot-protection/)[firewall](https://ps.wordpress.org/plugins/tags/firewall/)
   [geolocation](https://ps.wordpress.org/plugins/tags/geolocation/)[IP-blocking](https://ps.wordpress.org/plugins/tags/ip-blocking/)
   [security](https://ps.wordpress.org/plugins/tags/security/)
 *  [Advanced View](https://ps.wordpress.org/plugins/sentraip/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/sentraip/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/sentraip/reviews/)

## Contributors

 *   [ moveforwardltd ](https://profiles.wordpress.org/moveforwardltd/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/sentraip/)