Review login limits in Settings. Login constants now take effect when no saved override exists. Existing settings and connection details are preserved.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3706552,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3706552,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3706552,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3706552,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3706552,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.6.46","0.6.47","0.6.48","0.6.49","0.6.50"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3726860,"resolution":"1","location":"assets","locale":"","width":1440,"height":1100},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3726860,"resolution":"2","location":"assets","locale":"","width":1440,"height":1100},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3726860,"resolution":"3","location":"assets","locale":"","width":1440,"height":1100},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3726860,"resolution":"4","location":"assets","locale":"","width":1440,"height":1100}},"screenshots":{"1":"Protection active on an unconnected WordPress installation, with optional two-factor, crawler and account setup.","2":"Per-crawler AI policies: choose which recognized crawlers are allowed or blocked.","3":"Login limits, two-factor setup links and a custom login address in one place.","4":"File integrity and malware scan controls, with unscanned state shown accurately."}},"plugin_section":[],"plugin_tags":[259453,13859,9374,1229,9217],"plugin_category":[54],"plugin_contributors":[281942],"plugin_business_model":[],"class_list":["post-365458","plugin","type-plugin","status-publish","hentry","plugin_tags-block-ai-crawlers","plugin_tags-bot-blocker","plugin_tags-limit-login-attempts","plugin_tags-login-security","plugin_tags-two-factor","plugin_category-security-and-spam-protection","plugin_contributors-witenlabs","plugin_committers-witenlabs"],"banners":{"banner":"https:\/\/ps.w.org\/witen-blocker\/assets\/banner-772x250.png?rev=3706552","banner_2x":"https:\/\/ps.w.org\/witen-blocker\/assets\/banner-1544x500.png?rev=3706552","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/witen-blocker\/assets\/icon.svg?rev=3706552","icon":"https:\/\/ps.w.org\/witen-blocker\/assets\/icon.svg?rev=3706552","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/witen-blocker\/assets\/screenshot-1.png?rev=3726860","caption":"Protection active on an unconnected WordPress installation, with optional two-factor, crawler and account setup."},{"src":"https:\/\/ps.w.org\/witen-blocker\/assets\/screenshot-2.png?rev=3726860","caption":"Per-crawler AI policies: choose which recognized crawlers are allowed or blocked."},{"src":"https:\/\/ps.w.org\/witen-blocker\/assets\/screenshot-3.png?rev=3726860","caption":"Login limits, two-factor setup links and a custom login address in one place."},{"src":"https:\/\/ps.w.org\/witen-blocker\/assets\/screenshot-4.png?rev=3726860","caption":"File integrity and malware scan controls, with unscanned state shown accurately."}],"raw_content":"\n
Witen Blocker helps protect your WordPress site from password guessing, unwanted bots, and comment spam. Add two-factor authentication, check suspicious file changes, and review detections and blocks in your WordPress dashboard.<\/p>\n\n
Start with free local protection. Connect to Witen when you want blocklists informed by attacks seen across participating sites and servers.<\/p>\n\n
Limit repeated failed login attempts and add two-factor authentication with an authenticator app. Recovery codes give you a way back in if you lose your device.<\/p>\n\n
Built-in checks block template traversal and comment exploit requests before they reach the affected WordPress handlers. These checks work without an account. Keep WordPress, themes, and plugins updated as well.<\/p>\n\n
Choose which recognized search crawlers, AI crawlers, and automated clients to allow or block. Manage trusted addresses and review detections before blocking.<\/p>\n\n
Catch automated submissions with hidden form fields and timing checks. These checks run on your site without sending comment text to a spam service.<\/p>\n\n
Compare WordPress core files with official checksums, monitor changes in your content directory, and scan files for suspicious patterns. Bundled checks work without an account. Connected sites can receive maintained malware catalogs. Review findings before taking action.<\/p>\n\n
The optional Witen service combines security reports from participating sites and servers to identify repeat attackers and maintain shared blocklists. An enrolled site can block listed IPs even if they haven't attacked that site before. Reports are processed centrally; request checks use a local blocklist.<\/p>\n\n
Connecting requires a Witen account and security-event sharing. All local features are free, with no trial expiry. Free connected WordPress sites receive a daily threat-feed update without an added data delay. Paid plans add more sites and servers, other feed profiles, and optional off-site backup storage.<\/p>\n\n
On shared hosting, matching blocklist requests receive an HTTP 403 response from WordPress. No server administration access is needed. On your own server, the optional Witen Warden agent can enforce IP blocks at the firewall, before blocked traffic reaches PHP.<\/p>\n\n
Get started:<\/strong> activate Witen Blocker and open Witen > Dashboard<\/strong>. Local protection needs no account. Use Login<\/strong> for login limits and two-factor setup, and Firewall > Bots and AI crawlers<\/strong> to choose which crawlers can visit.<\/p>\n\n Setup guide<\/a> | Witen plans<\/a> | Support<\/a><\/p>\n\n Connected features use Background sync sends events and site details (listed below) and retrieves blocklists, bot identities, signed malware catalogs, Tor exit nodes, allowlists, service status, network statistics, and feed profiles. Profile changes send your selection and site identifier; IP lookups send the queried address. Block reports include the IP, rule, outcome, request context, and site identifier.<\/p>\n\n Witen terms<\/a> | Witen privacy policy<\/a><\/p>\n\n Enrolled sites refresh Cloudflare terms<\/a> | Cloudflare privacy policy<\/a><\/p>\n\n Integrity scans request official hashes from WordPress.org privacy policy<\/a><\/p>\n\n The plugin does not remotely load executable code or frontend assets. Bundled bot references cause no remote requests or crawler DNS lookups. Collector connections use your DNS resolver. Background jobs and Apache rule checks call your own WordPress URLs.<\/p>\n\n Events stay local until enrollment or explicit Warden socket configuration. Earlier events are never uploaded retroactively. Connected intelligence requires event sharing. Deactivate the plugin to stop reporting from WordPress; a separately running Warden keeps its own reporting configuration.<\/p>\n\n What is shared:<\/strong> IP addresses; successful and failed logins; XML-RPC, comment, registration, and 404 events; request URLs, methods, User-Agent strings, referrers, and query information; and attempted usernames, which may be email addresses. Installation reports include site name and URL, WordPress\/PHP\/plugin versions, and a random installation identifier. An observed IP is not necessarily an attacker. Reports help identify distributed attacks, relate failed logins to later successful ones, and maintain blocklists.<\/p>\n\n Event reports exclude form bodies, post content, comment text, password fields, cookies, and session data. URLs and metadata can contain personal data. File samples and .htaccess backups are separate options, described above. Local storage:<\/strong> the delivery queue holds up to 500 events for seven days. Witen also keeps the latest 100 dashboard events and blocks, block and allow lists, and health counters. Rejected events and block-decision reports have separate diagnostic queues, each limited to 100 records or 1 MiB. Older records are removed at the limit; diagnostics otherwise remain until uninstall.<\/p>\n\n Deactivation preserves settings and existing .htaccess and Warden firewall rules. Uninstall removes Witen options, transients, scheduled actions, and database tables. Collector retention follows its operator's privacy policy; request collector-side deletion from that operator.<\/p>\n\n\n See the setup guide<\/a> to connect a local Warden agent or configure your site through wp-config.php.<\/p>\n\n\n Login limits, two-factor authentication, comment spam checks, bot controls, file-integrity checks, bundled malware checks, and the .htaccess editor. Connecting to Witen adds hosted intelligence and reporting; it is optional.<\/p><\/dd>\n Normal request checks use local data and do not wait for a remote service. Updates, reporting, and scans run in background jobs and use server resources. On quiet sites, WordPress cron may wait for a visitor before running jobs.<\/p><\/dd>\n Check for overlapping two-factor, login, bot, and .htaccess settings. Test your login and site after changes. Keep WordPress, themes, and plugins updated, and maintain a backup.<\/p><\/dd>\n Open Witen > Login > Login lockout<\/strong> to set the failure window, failure count, and ban duration. Defaults are 5 failures in 5 minutes and a 1-hour ban. Saved settings override Keep your 2FA recovery codes. If locked out, wait for the ban to expire or follow the recovery guide<\/a>, including WP-CLI and SFTP steps. Deactivation leaves existing .htaccess and Warden firewall rules in place; the guide explains how to remove them.<\/p><\/dd>\n Not necessarily. A changed file or suspicious pattern needs review; legitimate customizations can produce findings. Witen helps identify files to investigate. It does not automatically clean an infected site.<\/p><\/dd>\nExternal Services<\/h3>\n\n
Witen Collector<\/h4>\n\n
https:\/\/collector.witenlabs.com<\/code>. Enrollment exchanges your setup token and installation identity for a credential. Witen processes shared reports to identify distributed attacks and provide threat intelligence.<\/p>\n\n\n
WITEN_SEND_MALWARE_SAMPLES<\/code> to boolean true<\/code> in wp-config.php<\/code> permits file-content uploads. Scans do not require them.<\/li>\nWITEN_COLLECTOR_URL selects another collector if you operate one; its operator's policies apply. Explicitly configuring `WITEN_SOCKET_PATH` authorizes sharing with local Warden, whose configuration controls onward delivery. Detecting a socket alone does not enable sharing.\n<\/code><\/pre>\n\nCloudflare proxy ranges<\/h4>\n\n
https:\/\/www.cloudflare.com\/ips-v4\/<\/code> and https:\/\/www.cloudflare.com\/ips-v6\/<\/code> during background maintenance to recognize trusted proxies. Offline sites use bundled ranges. Requests send ordinary HTTPS network metadata, not WordPress visitor events or account data.<\/p>\n\nWordPress.org core checksums<\/h4>\n\n
https:\/\/api.wordpress.org\/core\/checksums\/1.0\/<\/code>, sending your WordPress version, locale, and ordinary HTTPS network metadata. No visitor events, account data, or site content is sent.<\/p>\n\nPrivacy Policy<\/h3>\n\n
WITEN_NO_TELEMETRY<\/code> stops daily installation reports, but not connected security-event sharing.<\/p>\n\n\n
\n
What can I use without an account?<\/h3><\/dt>\n
Will it slow down my site?<\/h3><\/dt>\n
Can I use it alongside another security plugin?<\/h3><\/dt>\n
How do I change login limits or recover from a lockout?<\/h3><\/dt>\n
WITEN_LOGIN_WINDOW_SEC<\/code>, WITEN_LOGIN_MAX_FAILURES<\/code>, and WITEN_LOGIN_BAN_SEC<\/code> in wp-config.php. The same controls remain available in Settings.<\/p>\n\nDoes a scan finding mean my site is hacked?<\/h3><\/dt>\n