Visitor Sentinel is a security and traffic analysis plugin for WordPress. It combines real-time attack detection with an active deception layer, external threat intelligence, and progressive defense, so an attacker is not just noticed — they are challenged, tracked across devices, and lured into giving themselves away.

Detection

Records site visits (IP, page visited, user-agent, device/browser, account type).
Rules-based request scanning: SQL injection, XSS, path traversal, known scanner tools (sqlmap, nikto, wpscan, acunetix, gobuster), headless browsers (Selenium, Puppeteer, PhantomJS), automated HTTP client libraries, and access to sensitive paths (wp-config.php, .env, .git, id_rsa, backup files).
Analyzes every request in real time using multiple heuristics: unusual request rate, traffic-flood bursts, repeated failed logins, credential-stuffing patterns, XML-RPC abuse, invisible honeypot fields on login/comment forms, submission-timing checks, and scanning of non-existent pages (404).
Calculates a risk score per IP address — sheer browsing volume alone never triggers a block, only genuine attack/bot/spam signals do.
Medium-risk visitors are shown a lightweight JavaScript browser-verification challenge before a full block is applied.
Blocks are permanent by design. Lifting one requires a signed declaration, kept permanently in History.

Threat intelligence (optional, off by default)

AbuseIPDB lookup: cross-checks visitor IPs against AbuseIPDB’s abuse confidence score.
Tor exit-node detection: flags and penalizes traffic from known Tor exit nodes.
Automatic subnet banning: when several IPs from the same /24 (or /64 for IPv6) subnet get blocked, the whole subnet is banned automatically.

Deception layer (honeypots & honeytokens)

A decoy backup file (honeyfile) at a random, unlinked URL — any access to it is conclusive proof of directory scanning.
A decoy admin username that was never a real account — any login attempt against it is an instant, certain block.
A decoy REST endpoint that hands out a fake API key — using that key anywhere is what triggers the block, not merely finding it.
A decoy admin login page at a random, unlinked URL — visiting it triggers an instant block.
A hidden spam-trap email address planted only where scrapers read markup — if it ever comes back in a submitted form, that visitor harvested this exact site.
Every one of these bypasses the normal scoring threshold entirely: interacting with any of them is treated as certain malicious intent, not a “maybe.”

Device-aware banning

Blocks are tied to a private device-recognition cookie and, optionally, a browser fingerprint, not just an IP address — closing the gap where a blocked visitor’s IP changes (mobile networks reassign IPs, dual-stack IPv4/IPv6) but the same browser returns.

Management & visibility

A live dashboard, updated in real time (no page reload) via Server-Sent Events: visitor count, visit trend, top pages/referrers, threat-type breakdown, device breakdown, and geographic threat distribution.
Optional email alerts (plain text or HTML) and outgoing webhook notifications whenever an IP is blocked.
One-click CSV export of the blocked IPs list, and bulk unban/whitelist actions.
Displays, to logged-in users and optionally guests, a discreet badge showing how many people are on the site right now, updating live in the browser.
Built-in GDPR export/erase hooks for WordPress’s native privacy tools.
Fully responsive admin panel, usable on desktop, tablet, and phone.

All text is translation-ready. The plugin loads no external resources (CDN) and does not enable any third-party tracking by default. Every external integration (AbuseIPDB, Tor exit list, IP geolocation) is off by default and opt-in — see External Services below.

External services

This plugin can connect to third-party services, but only for optional, off-by-default features:

AbuseIPDB (api.abuseipdb.com) — used only if you enable “AbuseIPDB” in Settings and provide your own API key. When enabled, visitor IPs are sent to AbuseIPDB to check their abuse confidence score. Results are cached locally. Terms of Service and Privacy Policy.

Tor Project exit list (check.torproject.org) — used only if you enable “Tor blocking” in Settings. Downloads the public list of Tor exit-node IPs on a weekly schedule; no visitor data is sent to this service. Tor Project Privacy Policy.

IP-to-country lookup (ip-api.com) — used only if you explicitly enable “Geo Lookup” in Settings. When enabled, each new IP address seen by the plugin is sent to ip-api.com to look up which country it belongs to. Nothing else about the visitor is sent. Terms of Service and Privacy Policy.

If none of these settings are enabled, the plugin makes no external requests at all.