About this plugin
This administrator-only tool reads bounded CloudSecure or Wordfence log records. Repeated candidates default to 30 records of the same classification from the same IP within a rolling ten-minute window. Different classifications are never combined; a candidate still needs manual review.
htaccess editing are separate opt-ins, disabled by default. It is not a WAF, does not detect attacks, and never automatically blocks an IP based on its count.
Provider plugin pages: CloudSecure WP Security and Wordfence.
4, single-site WordPress and a same-directory site home are required for file editing. Select exact public IPs, review a preview, download the original file and confirm independent hosting/SFTP access before applying. htaccess bytes and manages only its own conditional-denial section.
Failed site checks attempt rollback but cannot guarantee recovery after process termination, hosting failures or concurrent changes. Verify compatibility on staging first. Deactivation/uninstall leaves server blocks and local recovery data intact.
Existing manual deny rules are not managed by this plugin.
Privacy
org update service. It contains no external update checker.
Source reads are administrator-triggered, limited to 10,000 retained rows and 200 IP/classification groups. Only IP, timestamp and classification fields are returned. Wordfence extracts a bounded category from valid JSON in the database; raw request data is not returned.
Provider logs are never modified. There is no telemetry, Hub, geolocation service, remote block list or background collection.
Configured IPs, up to three full configuration backups, and expiring preview/readiness/probe/lock data remain in the local database. Applying a change sends random-token self-probes to this site’s home URL, with no admin cookies, no redirects and normal TLS verification. Infrastructure access logs may contain those requests.
Keep configuration backups private.