Automatic IP blocking for WordPress
Go beyond detecting attacks.
Automatic IP blocking records suspicious behavior for each source IP over one hour. When the total reaches 10 points (the default threshold), it automatically blocks that IP.
Suspicious file searches, login failures, repeated form submissions. Even if the methods are different, if they are the same IP, they add up. Connection sources that meet the conditions will be rejected for 14 days.
Automatic IP blocking with cumulative scores
Suspicious behavior is recorded on an IP basis and automatically blocked when the cumulative total for one hour reaches a threshold.
Below is a mock example of standard settings (threshold 10 points, rejection 14 days).
Risk scoreTotal over one hour
3points
Blocking threshold 10 points
Automatic rejection after 7 points
Detection logSuspicious PHP file probing
adminer.php+3Cumulative total of 3 pointswp-update.php+3Total of 6 pointswp_filemanager.php+3Total of 9 pointsxwx1.php+3Total of 12 pointsA request probes the unpublished adminer.php file. Add 3 points to that IP.
1st time. Well, maybe it's a coincidence.
This is a mock example of standard settings. Not all attacks will be blocked in 4 tries.
/wp-content/plugins/adminer.phpA request probes the unpublished adminer.php file. Add 3 points to that IP.
1st time. Well, maybe it's a coincidence.
/wp-admin/js/wp-update.phpEven if the technique changes, the connection source is the same. The total is 6 points.
Different tactics. Still the same IP.
/wp-content/plugins/wp_filemanager.phpTotal of 9 points. One more point until the threshold.
Time to leave, perhaps?
/wp-content/plugins/xwx1.phpExceeds the standard threshold of 10 points and begins a 14-day denial. The reason and deadline remain on the admin screen.
If I come again, I'll add more.
You were asked to leave. Now you're blocked.
The denial period is based on the attack source IP. This is not the license expiration date.
The standard 14 days (set from 1 to 365 days) is the period during which attacking source IPs are denied. It will be automatically canceled at the end of the period, and future access will not be unconditionally denied. However, detection continues, and if the cumulative total reaches the threshold again, it will be automatically rejected again.
Example IP 192.0.2.45 But if you explore the following suspicious PHP files 4 times within an hour. Add up the 3 points for each, and when the fourth cumulative total of 12 points exceeds the standard threshold of 10 points, it will be automatically rejected.
/wp-content/plugins/adminer.phpCumulative total of 3 points/wp-admin/js/wp-update.phpTotal of 6 points/wp-content/plugins/wp_filemanager.phpTotal of 9 points/wp-content/plugins/xwx1.phpTotal of 12 points/Automatic shutoffThis is a mock example of standard settings. It's not an actual attack. The points allocated vary depending on the rule (3 points, 2 points, 4 points, etc.), the threshold can be changed from 5 to 50 points, and the rejection period can be changed from 1 to 365 days. Not all attacks will be blocked in 4 tries. Corresponding known patterns may also result in immediate rejection.
Protect each entry point.
IP auto-blocking is the final piece of advice. Before that, look at the SQL/suspicious search/login form at the entrance. The mechanism for stopping the game and the mechanism for accumulating points are considered separately.
Checks search/sort syntax and rejects on the spot. It will not be added to your IP score.
Detects private files and suspicious PHP names and adds 3 points for each detection.
Limit the number of failures and intensive access. Add 4 points when reaching the upper limit.
Limit the sending of Contact Form 7 by minutes or hours.
Automatic IP blocking
Suspicious searches, suspicious PHP, login failures, repeated form submissions. Separate detections are combined into an hourly score for the same connection source and automatically rejected with a standard score of 10.
SQL injection detection
Inspect highly reliable SQL syntax hidden in search, sort, and pagination input. It doesn't just rely on words, but also on the usage and syntax of the input.
SQL detection is rejected on the spot. It is not added to the IP score and is separated from long-term IP denials.
Suspicious probing detection
Detects searches for PHP names commonly used in configuration files, backups, and attacks. Add 3 points for each time.
Repeated form submission limits
Restrict transmissions from the same IP by minute or hour. You can also use hidden field and external URL inspection only when necessary.
Brute-force login protection
Temporary lock will occur if multiple login failures occur. When the upper limit is reached, 4 points will be added to your IP score. The number of times and lock time can be adjusted.
Logs and operations
Functions in detail.
You can check the details by opening each item. Also includes features enabled in settings.
Management screen (rejection list/history)
Don't end with "I blocked something." I will explain exactly why I stopped it. You can check the rejected IP, reason, cumulative score, and cancellation schedule on the usual WordPress management screen.
Be tough on attackers. Be kind to administrators.
Start with detection only and adjust with site-specific presets. We also provide a function to return to the previous settings, individual IP cancellation, and emergency cancellation.
It's immoral to suddenly be banned. First, record it, make sure that regular orders and inquiries go through, and then protect it. Settings can be returned to the previous setting.
Add products to cart, confirm order, move to payment. We introduce it while checking the flow that customers usually use. We provide presets for EC and settings to exclude known management Ajax such as Welcart.
Limit mass transmission from the same IP by minute or hour. You can restrict inquiries that include English or URLs only if necessary.
Custom forms are subject to the corresponding submission process. Not all forms are automatically protected.
Records suspicious access without stopping communication.
Try logging in and updating the article, and check the history and IP determination.
We also check the IP judgment of the proxy and operate automatic rejection.
Differences between Wordfence Free and Premium
Wordfence Free also has automatic blocking. However, the counting method is different. NagiShield aggregates "different types of suspicious activity" into an hourly score for the same IP.
Number of login failures, number of requests per minute, number of 404s. Set an upper limit for each item, and if it exceeds it, it will be temporarily restricted or blocked.
Strengths: WAF, malware inspection, and 2FA are free. Rules and signatures updated with a 30 day delay.
3 points for suspicious PHP search, 3 points for path tracing, 3 points for suspicious UA, 2 points for user name enumeration, and 4 points for reaching the upper limit for login failure. The separate detections are added to the hourly score, giving a score of 10 and 14 days of rejection.
Strength: Check the reason for judgment, total score, and cancellation schedule on the Japanese management screen.
Over 40,000 known attack sources are blocked from across the Wordfence network in real time. Rules and signatures are also delivered instantly.
$149USD / year
Official price as of October 2026NagiShield is available for purchase for ¥500.Wordfence Premium's shared IP blocklist and NagiShield's cumulative judgment are not the same functionality. NagiShield does not have a shared list and only evaluates actions within the site. It is not a replacement for Premium. If you want to use WAF, malware inspection, and 2FA for free, Wordfence Free is a strong choice.
| Feature | NagiShieldLaunch 500 yen/one-time purchase | Wordfence FreeFree version | SiteGuard WP PluginFree | AIOSFree version |
|---|---|---|---|---|
| Main protection range | SQL injection/suspicious probing detection/login/form protection | WAF/Malware inspection/Login protection | Focusing on protecting management screens and logins | WAF, login protection, spam measures, etc. |
| Automatic block judgment method | Combine multiple types of detection for each IP for 1 hour. Automatic rejection with standard 10 points | Temporary locking with upper limits for items such as number of failed logins and number of requests per minute | Lock IPs that repeatedly fail to log in | Automatically locks due to login failure etc. You can also set IP restrictions for comment spam. |
| Post-block management | Displays a list of reasons, start date and time, and cancellation schedule. Set individual cancellation/trusted IP/constant rejection | IP block list/release function available | Settings such as login lock | Manage locked IPs, rejection lists, audit logs, etc. |
| Continuous submission limit for Contact Form 7 | Limit transmissions from the same IP by minute/hour | No CF7-specific repeated submission limit stated in the reviewed documentation | Not listed in the list of confirmed official functions | No CF7-specific repeated submission limit stated in the reviewed documentation |
| Settings for EC sites | Exclude known managed Ajax such as EC presets and Welcart | Adjustment and operation confirmation required for each site | Adjustment and operation confirmation required for each site | Adjustment and operation confirmation required for each site |
| Malware inspection | Not equipped | Equipped with | Not listed in the list of confirmed official functions | Not included in the free version, available in Premium |
| two-factor authentication | Not equipped | Equipped with | Not listed in the list of confirmed official functions | Included in free version |
| price | 500 yen (tax included, one-time purchase) Launch price | 0 yen | 0 yen | 0 yen (free version) |
| Suitable usage | Automatically block suspicious IPs and review reasons and unblock them in a Japanese dashboard. | I want to use WAF, scanning, and two-factor authentication all at once. | I want to strengthen the entrance by changing the login URL, image authentication, etc. | I want to use a wide range of WAF, login protection, and anti-spam measures. |
As of October 26, 2026. We compare the current implementation of NagiShield with the official documentation for each product. "Not listed" does not mean that it is not compatible. This is a comparison of functions. The behavior varies depending on the settings of each product and the configuration of the site. Source:Wordfence Free、Wordfence price、rate limit、login protection、IP management、SiteGuard official feature list、AIOS free version、AIOS official feature list。
One-time purchase. No monthly fees.
Launch price
Tax included · one-time
Launch price until December 26, 2026 18:27One-time purchase. No monthly fees.
Regular price after 18:27 on December 26, 2026 1,500 yen (tax included, one-time purchase)
Can be used on sites owned by the purchaser. There is no set period for providing official updates. Release date: October 26, 2026. The launch price is valid until December 26, 2026 at 18:27 (Japan time). NagiShield itself is GPL-2.0-or-later, and key registration verifies the purchaser's access to official distribution and updates.
Contact us or request seller detailsFrom purchase to protection.
Check the price and offer conditions before purchasing. Enter your card information on the Stripe screen.
Open the purchase completion screen or the URL of the purchase email and enter the confirmation code sent to the email address used at the time of purchase. Get the ZIP and license key.
Install and activate ZIP on WordPress. Enter the key and email address at the time of purchase in NagiShield's "Update/License" and register this site with the confirmation code.
Can be used on sites owned by the purchaser. There is no set period for providing official updates. Release date: October 26, 2026. The launch price is valid until December 26, 2026 at 18:27 (Japan time).
Things to check before installing.
It does not prevent all attacks. Use it in conjunction with WordPress and other plugin updates, backups, and WAF for servers and CDNs. Communication before WordPress starts and direct execution of files are not protected.
It is intended for use in addition to server-side defense. NagiShield determines suspicious behavior on the WordPress side, automatically rejects it, and checks history. After installation, please confirm normal operation for each site.
Choose the protection that suits your site using e-commerce presets and exception settings. When installing, check the normal operation using only detection, and if there are no problems, enable protection.
Normally you don't need to do anything, as it will be automatically canceled when the set period ends. If you are sure that a false blocking has occurred, you can check the reason and history on the management screen and cancel it individually. Adjust trusted IPs and exceptions, and revert to detection only if necessary. In case you cannot access the management screen, we have also prepared an emergency cancellation procedure. In a shared IP or CDN environment, first check the determination of the connection source.
It is not designed to block just that word. It distinguishes between searches and sorting and free descriptions such as the inquiry text, and makes judgments based on multiple characteristics. SQL detection rejects requests on the spot, but does not add points to your IP score and is separate from long-term IP rejections. Fundamental countermeasures require appropriate prepared statements on the application side.
Once the denial period ends, the IP will be automatically canceled. The first access after cancellation will not be unconditionally denied, but detection will continue. If suspicious behavior accumulates again and reaches the threshold, it will be automatically rejected again. The 14th is not a license or renewal deadline, but a period to deny the attacking IP. If you wish, you can add the IP to the "Always Reject Connections" list.
Can be used together. However, if both parties stop the same communication, it will be difficult to trace the cause on the management screen. Please separate the roles of Wordfence into WAF, malware inspection, and 2FA, and NagiShield into cumulative judgment by IP and Japanese language rejection management. Wordfence Free's automatic blocking is determined based on upper limits for items such as the number of failed logins and the number of requests per minute. It is not a method that combines different types of detection like NagiShield.
On the purchase completion screen or the URL of the purchase email, enter the confirmation code sent to the email address used at the time of purchase. Once you have obtained the ZIP and key, enter the key and the email address at the time of purchase in NagiShield's "Update/License" and register this site using the confirmation code you received. Once you are “registered”, you can use WordPress standard update notifications, one-click updates, and automatic updates. You can register multiple sites that you own using the same key and email address, and there is no upper limit on the number of sites. There is no set period for providing official updates. The key is used to receive official updates, and the current defense functions will work even if you are not registered.
Returns and cancellations for a change of mind are generally not accepted. Your statutory rights and remedies for a non-conforming product remain unaffected. See Terms of sale & usePlease check. Now accepting purchases.
No. The IP automatic blocking demo on the page is simulated data that shows an example of how it works with standard settings. Being blocked after 4 attempts is an example of a case where each 3-point search continues 4 times in an hour; not all attacks will be blocked after 4 attempts. The image on the management screen is a record of what was actually detected and blocked in the test environment, and the IP is the document address. It does not indicate the number of attacks or defense rate in actual operation.