ThreatPoint IP Reputation Plugin Documentation

1. Executive & Technical Overview

Purpose of ThreatPoint IP Reputation

ThreatPoint IP Reputation protects WordPress websites, login portals, and sensitive pages from malicious access attempts by querying the ThreatPoint IP Reputation consortium service in real time. Attackers frequently launch credential stuffing, brute-force logins, XML-RPC amplification, and vulnerability scans from compromised hosts, anonymizer VPNs, Tor exit relays, and high-risk autonomous systems (ASNs).

By evaluating visitor IP addresses on page load and login attempts, ThreatPoint IP Reputation enables administrators to block or redirect traffic based on minimum IP risk tier (High, Consider, Low), Tor exit node status, VPN/proxy anonymizers, and ISO country blacklists or whitelists—while also providing one-click .htaccess synchronization to block XML-RPC and known malicious consortium IPs at the web server layer.

Primary API Endpoint: https://verifyb.threatpoint.co.uk/api/v1/resources/ip

Real-Time Consortium IP Risk Scoring

Queries the ThreatPoint IP Reputation REST API (/api/v1/resources/ip) to classify every visitor IP into actionable risk tiers (High, Consider, Low) backed by historical consortium abuse data.

Tor Exit Node & Anonymizer VPN Blocking

Detects and blocks requests originating from active Tor exit relays as well as paid and free anonymizer VPN and proxy networks.

ISO Country Blacklist & Whitelist Geo-Fencing

Allows administrators to block specific countries by 2-character ISO code (e.g., CN, RU, KP) or restrict site access exclusively to whitelisted countries (e.g., GB, US, IE).

Search Engine Bot Allowlisting

Optionally exempts legitimate search engine crawlers (such as Googlebot, Bingbot, and DuckDuckBot) from IP and geographic restrictions so SEO indexing is never impacted.

Web Server (.htaccess) Hardening & Feed Sync

Can disable xmlrpc.php at the Apache/.htaccess level and synchronize up to 1,500 active malicious consortium IPs directly into .htaccess for zero-PHP-overhead blocking.

Smart Transient Caching & Reverse-Proxy Awareness

Caches clean IP reputation lookups using WordPress transients for 1 hour to maximize site speed and conserve API quota, while automatically resolving the true external visitor IP behind Cloudflare, Nginx, and load balancers.

2. Installation & Activation Guide

Installing via the WordPress Plugin Store

Follow the steps below to install ThreatPoint IP Reputation directly from the WordPress Plugin Store (or via the threatpoint-api.zip distribution archive) and connect your ThreatPoint API key.

1

Step 1: Open the WordPress Plugin Store

Log in to your WordPress Administrator Dashboard (wp-admin). In the left-hand navigation menu, select Plugins -> Add New Plugin.

2

Step 2: Search for ThreatPoint IP Reputation

In the Search Plugins box in the top-right corner, type "ThreatPoint IP Reputation". Locate the official plugin by ThreatPoint and click Install Now. (Alternatively, click Upload Plugin, select threatpoint-api.zip, and click Install Now.)

3

Step 3: Activate the Plugin

Click Activate after installation completes. A new top-level menu item titled ThreatPoint IP Rep (with the ThreatPoint shield icon) will appear in your WordPress admin sidebar.

4

Step 4: Configure Your ThreatPoint API Key

Open ThreatPoint IP Rep -> 1. API Key, Paywall & Scope. Enter your ThreatPoint X-Api-Key (available from api@threatpoint.co.uk) and click Save API & Scope Settings.

5

Step 5: Test API Connection & Review Policies

Click the "Test API Key & Sync Quota" button in the header banner to verify connectivity. Then open Tab 2 (IP Risk, Geo & Bot Policies) to customize your risk threshold, Tor/VPN blocking, and country rules.

API-Key Requirement & 200-Query Paywall Overview

API-Key Requirement: A valid ThreatPoint API Key (X-Api-Key) is required to query the ThreatPoint IP Reputation service. Obtain your key from the ThreatPoint API team at api@threatpoint.co.uk.

200 Included Queries (Pre-Paywall Tier): The plugin includes 200 live IP Reputation API lookups out of the box (enhanced by 1-hour per-IP transient caching so repeat page views from the same visitor do not consume additional queries).

Commercial Paid Tier Upgrade: When all 200 included queries are used, the plugin enters the Paywall Active state and stops making live API queries until upgraded. Contact api@threatpoint.co.uk to upgrade your key, then check "Commercial Paid Tier Unlocked" in Tab 1.

3. Administration & Policy Reference

Configuring ThreatPoint IP Reputation

Access the configuration dashboard in WordPress by clicking ThreatPoint IP Rep in the left-hand admin navigation sidebar. All settings are organized into logical tabs below the live API Key & 200-Query Paywall status card.

Tab 1: API Key, Paywall & Scope

Configures your ThreatPoint API credentials, commercial tier status, protected page scope, and .htaccess server rules.

Setting / Control	Type / Options	Purpose & Recommended Configuration
ThreatPoint API Key (X-Api-Key)	Password / String	Your ThreatPoint API key required for /api/v1/resources/ip, /ipstats, and /mal endpoints.
Commercial Paid Tier Unlocked	Checkbox	Unlocks unlimited commercial quota once your API key has been upgraded by the ThreatPoint API team.
Pages to Check	Comma-separated slugs/paths	Specify particular page slugs or paths to inspect (e.g., contact, checkout, /my-account). Leave blank to protect ALL pages and wp-login.php.
Disable XML-RPC Endpoint (.htaccess)	Yes \| No (Default: No)	Writes <Files xmlrpc.php> Require all denied </Files> markers into your root .htaccess file to stop XML-RPC brute-force attacks.
Auto-Block Known Malicious IPs (.htaccess)	Yes \| No (Default: No)	Fetches the ThreatPoint malicious IP feed (/api/v1/resources/mal) and writes Require not ip rules directly into .htaccess.

Tab 2: IP Risk, Geo & Bot Policies

Controls when an incoming IP address is blocked or redirected and whether security alert emails are sent.

Setting / Control	Type / Options	Purpose & Recommended Configuration
Reject IP Risk Threshold (>=)	High Only \| Consider & High \| Low, Consider & High	Determines the minimum ThreatPoint risk tier that triggers a block. Recommended: High Risk Only or Consider & High Risk.
Reject Tor Exit Nodes	Yes \| No (Default: Yes)	Blocks requests where the ThreatPoint risk profile identifies an active Tor exit node.
Reject Anonymizer VPNs & Proxies	Yes \| No (Default: No)	Blocks requests originating from commercial or free anonymizer VPN and proxy servers.
Country Blacklist (ISO 2-Char CSV)	Comma-separated ISO codes	Blocks visitors from listed 2-character country codes (e.g., CN, RU). Evaluated prior to the country whitelist.
Country Whitelist (ISO 2-Char CSV)	Comma-separated ISO codes	When populated, ONLY visitors from the listed countries (e.g., GB, US) are permitted access; all other countries are blocked.
Allow Specific Search Engine Bots	Yes \| No + Bot Token List	Bypasses IP and country blocks when the visitor User-Agent matches configured crawler tokens (e.g., googlebot, bingbot).
Blocked Traffic Redirection URL	URL (Optional)	Redirects blocked visitors to a custom URL. If left blank, the plugin displays the built-in ThreatPoint HTTP 403 Access Denied screen.
Enable Email Alert Notifications	Yes \| No + Recipient Email	Sends an automated security alert email via wp_mail() detailing the blocked IP, reason, city, and country.

Tab 3: Live IP Reputation Stats & Lookup

Displays live site statistics and top high-risk IP requests recorded against your API key.

Setting / Control	Type / Options	Purpose & Recommended Configuration
KPI Summary Counters	Dashboard Cards	Displays Total IP API Queries, Blocked IP Requests on this WordPress site, and Queries Remaining.
Top High-Risk IP Requests Table	Live Feed (/ipstats)	Displays the Date, Risk/Threat Detail, IP Address, and Total Hits for the top high-risk IP addresses targeting your site.