Mcpelee Site Security Guard

Mcpelee Site Security Guard provides access control and security monitoring through Settings > Mcpelee Site Security Guard. The dashboard includes IP blocking, security settings, file scanning, and logs. The administration interface is currently in Korean.

Features

• IPv4, IPv6, and CIDR block and allow lists.
• Apache-compatible redirects to a static error page before WordPress runs.
• A 24-hour cache policy for the static page; IP-dependent redirects use private, no-store.
• Country blocking with country allow exceptions using server-provided GeoIP information.
• Temporary login failure limits, security headers, optional XML-RPC blocking, and REST user lookup restrictions.
• Optional access logs and country lookup, sorting, clickable filters, and per-administrator preferences.
• SHA-256 file change monitoring and optional daily scans through WP-Cron.

Server requirements

WordPress 6.0 or later, PHP 8.0 or later, and a single-site installation are required.

Server-level blocking requires Apache 2.4 with mod_rewrite, mod_headers, AllowOverride FileInfo, or a compatible LiteSpeed configuration. The site home .htaccess, the rewrite root returned by get_home_path(), must be writable. Saving the IP policy generates both blocking and static-page header rules in a plugin-managed section. No hidden .htaccess file is shipped inside the plugin.

Nginx and the PHP development server do not process .htaccess. PHP fallback protection applies to WordPress requests, not every static file. A CDN that serves responses before reaching the origin needs its own access rules. Trusted proxies must restore the real client IP at the server level.

Country blocking requires a server GeoIP module and database providing MM_COUNTRY_CODE or GEOIP_COUNTRY_CODE before rewrite processing. The plugin does not install these dependencies. Requests with unknown countries are not country-blocked. IP allow rules take priority over IP block rules, followed by country allow exceptions and country blocks. A country allow list is not an exclusive list of permitted countries.

Storage and retention

Optional access logs store the IP, request method, URL path, and response status. Query strings, request bodies, passwords, and cookies are not logged. Sensitive data embedded in URL paths may still be recorded. Access logging adds one database write per WordPress request. Requests blocked by the web server are available in server logs, not plugin logs.

Logs default to seven days of retention, configurable from 1 to 90 days. Hourly cleanup retains at most 20,000 recent records; the count can exceed this between cleanup runs. File scans store paths and hashes, not original file contents. Detected changes are investigation clues, not proof of intrusion or a malware diagnosis.

Deactivation removes the plugin-managed server rules and scheduled tasks. Settings, logs, country cache, file baselines, and administrator preferences remain in the database after deactivation or deletion.

Distribution and compatibility

Classes and constants use MCPELEE_SSG_; hooks, options, caches, and database tables use mcpelee_ssg_. Internal filenames and CSS identifiers use mcpelee-ssg-. Legacy development identifiers are recognized only for migration or compatibility.

Standard WordPress filenames, the main plugin filename, and the static error page URL remain stable. Developer tests and build scripts are excluded from the release ZIP. No custom Update URI header is used.

External services

IPWhois country lookup (optional)

This feature is disabled by default and runs only after an administrator enables IP country lookup in the Logs tab.

• Purpose: Display an estimated country for logged IP addresses.
• Timing: When an administrator views logs, visible public IPs without a valid cache are queried asynchronously. Visitor requests do not trigger external lookups.
• Data sent: The public IP being queried is included in the HTTPS request path to https://ipwho.is/. The provider can also see the server’s source IP and standard WordPress HTTP client information. Account information, cookies, and log message contents are not included as request data.
• Caching: Successful results are cached for 30 days and failures for one hour. Private and reserved addresses are not queried. Estimates may differ from the visitor’s actual location and do not establish historical location.
• Documentation: https://ipwhois.io/documentation
• Terms: https://ipwhois.io/terms
• Privacy policy: https://ipwhois.io/privacy

Server GeoIP country blocking does not call this API. Server administrators separately manage their GeoIP module, database updates, and the applicable provider terms.

Upgrading from the pre-release name

Deactivate Site Security Guard before installing Mcpelee Site Security Guard. Do not activate both copies together. Settings, logs, and file baselines use the same mcpelee_ssg identifiers and are retained. Activate the new plugin to regenerate enabled server rules with the new static-page URL. Remove the old plugin folder only after verifying the new installation.