v1.0

wp-security-pack/includes/class-wpsp-admin.php

@@ -953,9 +953,9 @@ class WPSP_Admin {
 						<strong><?php esc_html_e( 'GeoIP Database Required', 'wp-security-pack' ); ?></strong><br>
 						<?php
 						printf(
-							/* translators: %s: Link to Geo Blocking tab */
+							/* translators: %s: Link to IP Control tab */
 							esc_html__( 'Country detection requires the GeoIP database. Please download it from the %s tab.', 'wp-security-pack' ),
-							'<a href="#" onclick="document.querySelector(\'a[href=\\\'#geo-blocking\\\']\').click(); return false;"><strong>' . esc_html__( 'Geo Blocking', 'wp-security-pack' ) . '</strong></a>'
+							'<a href="' . esc_url( admin_url( 'admin.php?page=wp-security-pack&tab=ip' ) ) . '"><strong>' . esc_html__( 'IP Control', 'wp-security-pack' ) . '</strong></a>'
 						);
 						?>
 					</p>
@@ -2610,11 +2610,15 @@ class WPSP_Admin {
 					<td><?php echo esc_html( WPSP_VERSION ); ?></td>
 				</tr>
 				<tr>
-					<td><strong><?php esc_html_e( 'Your IP Address', 'wp-security-pack' ); ?></strong></td>
+					<td><strong><?php esc_html_e( 'Server IP Address', 'wp-security-pack' ); ?></strong></td>
 					<td>
-						<code><?php echo esc_html( $current_ip ); ?></code>
-						<?php if ( $country_code ) : ?>
-							<?php echo esc_html( WPSP_Helper::get_country_flag( $country_code ) . ' ' . $country_code ); ?>
+						<?php
+						$server_ip = WPSP_Helper::get_server_ip();
+						if ( $server_ip ) :
+							?>
+							<code><?php echo esc_html( $server_ip ); ?></code>
+						<?php else : ?>
+							<em><?php esc_html_e( 'Unable to detect', 'wp-security-pack' ); ?></em>
 						<?php endif; ?>
 					</td>
 				</tr>

wp-security-pack/includes/class-wpsp-helper.php

@@ -464,6 +464,55 @@ class WPSP_Helper {
 		return $slug;
 	}
 
+	/**
+	 * Get the server's public IP address.
+	 *
+	 * Uses external service to determine the server's outbound IP.
+	 * Result is cached for 1 hour to avoid excessive external requests.
+	 *
+	 * @return string|null Server IP or null on failure.
+	 */
+	public static function get_server_ip() {
+		$cached = get_transient( 'wpsp_server_ip' );
+		if ( false !== $cached ) {
+			return $cached;
+		}
+
+		// Try multiple services for reliability.
+		$services = array(
+			'https://api.ipify.org',
+			'https://ifconfig.me/ip',
+			'https://icanhazip.com',
+		);
+
+		$ip = null;
+
+		foreach ( $services as $service ) {
+			$response = wp_remote_get(
+				$service,
+				array(
+					'timeout'   => 5,
+					'sslverify' => true,
+				)
+			);
+
+			if ( ! is_wp_error( $response ) && 200 === wp_remote_retrieve_response_code( $response ) ) {
+				$body = trim( wp_remote_retrieve_body( $response ) );
+				if ( filter_var( $body, FILTER_VALIDATE_IP ) ) {
+					$ip = $body;
+					break;
+				}
+			}
+		}
+
+		if ( $ip ) {
+			// Cache for 1 hour.
+			set_transient( 'wpsp_server_ip', $ip, HOUR_IN_SECONDS );
+		}
+
+		return $ip;
+	}
+
 	/**
 	 * Get country flag emoji from country code.
 	 *

wp-security-pack/readme.txt

@@ -0,0 +1,128 @@
+=== WP Security Pack ===
+Contributors: arkhost
+Tags: security, firewall, login, 2fa, malware
+Requires at least: 5.0
+Tested up to: 6.9
+Requires PHP: 7.4
+Stable tag: 1.0
+License: GPLv2 or later
+License URI: https://www.gnu.org/licenses/gpl-2.0.html
+
+WordPress security without the nonsense. No upsells, no premium tier, no fake threat counters.
+
+== Description ==
+
+A complete security plugin that's actually free. No "pro" version, no nag screens, no made-up threat statistics.
+
+= Login Protection =
+* Blocks IPs after failed login attempts
+* Custom login URL (hides wp-login.php)
+* Hides wp-admin from logged-out users
+* Honeypot field for bots
+* Hides login errors (stops username enumeration)
+* Email alerts for admin logins from new IPs
+* Country/IP restrictions on login page
+
+= IP Control =
+* Whitelist and blacklist
+* Auto-blacklist after repeated lockouts
+* IPv4, IPv6, CIDR supported
+
+= Geo Blocking =
+* Block countries
+* Uses free IP2Location LITE database
+* One-click download
+
+= Hardening =
+* Disable XML-RPC
+* Disable dashboard file editing
+* Disable application passwords
+* Restrict REST API to logged-in users
+* Remove WordPress version
+* Block user enumeration (?author=1 and REST API)
+* Disable pingbacks/trackbacks
+
+= Security Headers =
+X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Content-Security-Policy, HSTS
+
+= Two-Factor Authentication =
+* TOTP (Google Authenticator, Authy, etc.)
+* Backup codes
+* Enforce for admins
+
+= File Integrity Monitoring =
+* Checks WordPress core files against official checksums
+* Daily scans
+* Email alerts on changes
+
+= Malware Scanner =
+* Scans plugins, themes, uploads
+* Pattern-based detection
+* Quarantine suspicious files
+* Weekly scans
+
+= Activity Log =
+* Login attempts, lockouts, blocks
+* IP, country, username, timestamp
+* Configurable retention
+* CSV export
+
+= Tools =
+* Export/import settings
+* Force logout all users
+* Test email
+* Delete readme.html/license.txt
+
+= Privacy =
+
+No tracking. No analytics. No telemetry.
+
+External connections:
+* WordPress.org API (core file checksums)
+* IP2Location (database download, only when you click it)
+
+== Installation ==
+
+1. Upload the plugin files to `/wp-content/plugins/wp-security-pack/`
+2. Activate the plugin through the 'Plugins' screen
+3. Configure under the Security menu
+
+== Frequently Asked Questions ==
+
+= Is there a premium version? =
+
+No. This is the complete plugin.
+
+= Will it slow my site? =
+
+No. Checks run on login and admin access, not frontend page loads.
+
+= I locked myself out =
+
+Connect via FTP/SSH and rename the plugin folder. Log in normally. Fix your settings.
+
+= Does geo-blocking work without the database? =
+
+No. Download the free IP2Location LITE database from the plugin settings.
+
+= Can I use this with other security plugins? =
+
+Possible but likely to cause conflicts. We recommend using one security plugin at a time.
+
+== Screenshots ==
+
+1. Security status overview
+2. Login protection settings
+3. Activity log
+4. Two-factor authentication setup
+5. Malware scanner with quarantine
+
+== Changelog ==
+
+= 1.0 =
+* Initial release
+
+== Upgrade Notice ==
+
+= 1.0 =
+Initial release.