TOOL1 Firewall Pro

Firewall & Login Protection Pro by TOOL1 is the paid add-on for the free Firewall & Login Protection by TOOL1 plugin. The free plugin guards your login page. Pro adds a firewall, WordPress hardening, country blocking and a full security dashboard. It plugs into the free plugin (version 7.0.0 or newer), so blocks, logs and settings all stay on one settings page.

Firewall

• Malicious request blocking: requests carrying common attack patterns are blocked and the IP is banned. Examples are path traversal (../../), /etc/passwd, wp-config.php probes and eval( or base64_decode( injections. You can edit the list.
• Bad bot blocking: known scanners and scrapers, plus requests with no user agent at all, are blocked. You can edit the list.
• POST rate limit: an IP that sends too many POST requests in a set time is stopped and banned. By default that’s 15 per minute.
• Whitelists: trusted IP addresses and user agents (such as Googlebot) skip every check.

WordPress hardening

Turn each of these on with a single checkbox:

• turn off XML-RPC completely
• limit the REST API to logged-in users, with a whitelist for routes other plugins need and optional request logging
• hide the WordPress version
• disable the theme and plugin file editor
• remove emoji scripts, RSS feeds, oEmbed, the wlwmanifest link and the profile link from your pages

GeoIP country blocking

• Block selected countries, or allow only selected countries.
• Apply it to the whole site, or only to the login page so search engines aren’t affected.
• The free GeoIP country database downloads in one click.

Bot visit analytics

• See which crawlers visit your site and when, including Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot and AhrefsBot, with charts and a daily log.
• See which pages each bot crawled, plus a “Bot Visits” column in your Posts and Pages lists.

robots.txt editor

• Edit robots.txt from the dashboard. Your sitemap address is detected and added automatically.

Security dashboard

• A security score based on the hardening features you’ve turned on.
• Attacks blocked in the last 24 hours, active bans, server load and memory, and PHP, MySQL and cron status.
• A firewall event log that you can search, group by IP or user agent, and use to ban in one click.
• Lists of banned IPs, networks and user agents, and of logged-in administrators, so you can end their sessions.
• An external cron URL for sites where WP-Cron is turned off.

Licensing and updates

• A license key from tool1.app turns on the Pro features and automatic updates.
• The license is re-checked daily. If tool1.app can’t be reached, Pro keeps working for 14 days.
• Without a valid license, the free features keep working.

Requirements: the free Firewall & Login Protection by TOOL1 plugin, version 7.0.0 or newer. WordPress 5.9 or newer and PHP 7.4 or newer.