NoHackMe Defender

Demo page of the NoHackMe Defender plugin

Download:WordPress.orgGitHub

The NoHackMe Defender plugin ensures the security of your WordPress site by blocking IP addresses when receiving suspicious requests from them, as well as when too many requests are received from a single IP over a certain period of time.

WordPress compatibility: 6.0–7.1.3.

To test the hacking protection, enter suspicious data in this form.

For example, enter "base64_decode("

If the data is found and intercepted, access to the site will be blocked.

If no suspicious data is detected, you will see a message about the successful submission of the form.

    How your details are handled

    Controller: FOP Klymenko Roman. Your name, email address, link and message are used to answer your inquiry and discuss the requested work. The legal basis for steps you request before a contract is GDPR Article 6(1)(b). The details are sent to the site owner by email and Telegram. Google reCAPTCHA loads only when you submit the form to prevent automated requests; Google may process technical browser and request data. Email, Telegram or Google may process data outside the EEA under their terms. The details are kept only as long as needed to handle your inquiry and related follow-up. You may request access, correction or deletion using the contact email contact form. Please do not include special-category personal data.

    Protection against suspicious file scans

    NoHackMe Defender also blocks requests to sensitive paths that automated scanners look for, including credentials, configuration files, and admin panels of other CMS and CRM systems. The plugin checks each request against its suspicious-path list.

    Test it: open /composer.json. This file does not exist on this site, so the request should be blocked.

    Testing will temporarily block the IP address you use. Open the link only if you can remove your address from the plugin’s blocked IP list.

    Also, you can refresh the website page many times.

    If you manage to refresh the page more than 100 times in a minute, access to the site will also be blocked.

    …But it’s not that easy 😉

    Play video: How to Protect Your Site from Hackers, parsing and DoS. Testing WordPress Plugin NoHackMe Defender
    How NoHackMe Defender Plugin Works

    Look at this video to visually see how the NoHackMe Defender plugin works.

    …And not to suffer, refreshing the page 🙂

    Do not worry if access to the site is blocked. By following a special address, you will be able to cancel the block.

    Play video: 🔒 Protect Your WordPress Site for Free - Installing and Configuring NoHackMe Defender Plugin 🔒
    Analysis of the free features of the NoHackMe Defender plugin

    Settings and Administrative Sections of the Plugin

    Watch this video to familiarize yourself with the NoHackMe Defender plugin settings, as well as the sections created for managing blocked IP addresses.

    Frequently Asked Questions

    Is NoHackMe Defender completely free?

    Yes. The plugin is fully free; there is no separate paid or Premium version. All functionality in the current release is available without a paid upgrade. Download it from the WordPress.org plugin directory.

    Can the plugin show which country a suspicious IP belongs to?

    Yes. When the GeoIP files are installed, the country code appears in the Blocked IP table in the WordPress admin area.

    Download the Sypex Geo PHP API and the Sypex Geo Country database from the official Sypex Geo download page. This plugin expects the files to be named SxGeo.php and SxGeo.dat.

    Place both files in the GeoIP directory inside WordPress uploads: wp-content/uploads/nohackme-defender/geo/. Create the folders if needed. If your site uses a custom uploads directory, use that instead of wp-content/uploads. This folder is outside the plugin, so plugin updates will not remove the GeoIP files.

    For backward compatibility, the plugin also checks the old wp-content/plugins/nohackme-defender/lib/geo/ folder. Both files must be in the same folder. IP blocking still works without GeoIP files, but the country is shown as unknown.

    What kinds of attacks does NoHackMe Defender help block?

    It checks request URLs, query strings, parameters, User-Agent values, and request bodies for suspicious fragments associated with SQL injection, cross-site scripting (XSS), command or code execution, and directory-traversal attempts. It also blocks probes for sensitive files and paths such as exposed configuration files, environment files, source-control folders, backups, and debug endpoints.

    The plugin can also temporarily block an IP that exceeds the configured request limits within a minute, 10 minutes, or 50 minutes. These are request-pattern and rate checks; they help reduce common automated probes and floods, but do not stop every attack or replace hosting-level DDoS protection, updates, and backups.

    Why did the plugin add code to wp-config.php?

    During activation, the plugin adds a small require_once include for its early request-check file immediately after the opening PHP tag in wp-config.php. That lets NoHackMe Defender inspect a request before WordPress and its plugins finish loading. When a request matches a blocking rule, it can stop processing early, reducing PHP, database, and plugin work for that request.

    This line is expected. The plugin removes its own include line when it is deactivated; it does not need to change your database credentials.

    What should I do if my own IP address is blocked?

    In the WordPress admin area, open NoHackMe → Blocked IP and use Delete on the row for your address. The same screen also has an option to unlock all currently blocked IPs.

    Protect your website with the NoHackMe Defender plugin

    • Hacking protection.
    • Parsing protection.
    • DoS protection.
    • Password brute force protection.
    Play video: How to Protect Your Site from Hackers, parsing and DoS. Testing WordPress Plugin NoHackMe Defender
    How NoHackMe Defender Plugin Works