Deskmode Pro Suite – Customize & Secure Your WordPress Admin
A WordPress admin plugin to Customize and secure your WordPress dashboard
Every IP in your logs is a link
WordPress IP lookup and attack tracing
Click it and you get the country, the network owner and the AS behind the attempt. Then block that address, or its whole country, without opening a second tool.From a log line to the origin in three clicks, not three browser tabs.
trace WordPress login attacks
Find the origin and close it, on the same screen
Tracing an attempt normally means copying an address, opening a lookup site, opening another one for WHOIS, then coming back to add it to a list. Deskmode keeps all four steps inside the dashboard.
Check a suspicious IP address straight from the log
- In the activity log and in the security screen, every address opens the Network Info page already filled in with that IP — the lookup runs on arrival.
- A Block button next to the address adds it to the manual blocklist without reloading the page.
- Addresses already listed show a Blocked label instead of a button.
- If an address is on the allowlist, no button appears at all: the allowlist takes priority, so Block would promise an effect that never happens. The row says Authorized.
- Both lists are matched by CIDR and wildcards too, not by exact string comparison.
What you learn about an attacker
- Where it is: country and country code, region, city and a point on the map. The same code drives the flag shown next to the address in the logs.
- Who owns the network: ISP, organisation and AS number. The AS detail adds the operator, its regional registry, the allocation date and every announced prefix — enough to tell a residential line from a hosting provider or a VPN exit.
- What the name says: the reverse DNS record, falling back to a local PTR query.
- Its reputation: five mail blacklists checked in one pass.
- Whether it is shared: how many domains resolve to the same address.
The overview on the dashboard
The widget sums up blocked attempts over the last 24 hours and the last 7 days, failed logins over the last 24 hours, and a 7-day chart with both series plotted separately: a request refused by your rules and a wrong password are not the same event and are never merged. Below it, the five countries with the most blocks in the last day and a map where each country is a circle whose area is proportional to the number of blocks, so one very large source cannot visually erase the rest.
Trace WordPress login attacks and create a rule that stops them
Once you know where the traffic comes from, geofencing turns that into a rule: allow only the countries you choose, on the login form or on the whole site.
Anti-lockout: if you save rules that would leave your own address outside, your current IP is added to the allowlist automatically. Tracing an attacker should never lock out the administrator.
A quick note on WordPress IP lookup: the widget reads the counter, not the log. The detailed log is rate-limited to one entry per address every ten minutes so an attack cannot flood it — counting from the log would give an arbitrary fraction of reality.
Frequently asked about WordPress IP lookup
WordPress IP lookup: the questions we get most
Five answers on what you learn about an address, how reliable it is, and what leaves your server.
What exactly do I learn about an IP address?
The reverse DNS record, country and country code, region, city, ISP, organisation and AS number, with the location on a map. Alongside it you get how many domains resolve to the same address — useful for telling a dedicated attacker from a shared host — and the result of a check against five blacklists.
The AS detail adds the operator that owns the network, its regional registry, the allocation date and the prefixes it announces: that is what lets you tell whether you are looking at a residential line, a hosting provider or a VPN exit node.
How WordPress IP lookup works and how accurate is the geolocation?
Reliable at country level, much less so at city level. Geolocation databases map blocks of addresses to approximate coordinates, and for mobile IPs or those behind large providers the city shown is often the operator’s base rather than the visitor’s.
So the country is solid enough to make decisions on — it is what geofencing works from — while city and coordinates should be read as an indication, not as evidence. No rule in the plugin relies on anything finer than the country.
What does it mean if an address appears on a blacklist?
The five zones checked are anti-spam blacklists, the best known being the Spamhaus ZEN blocklist. Finding an address there means it has already been reported for sending spam or for belonging to a botnet.
It is a strong signal but not a verdict: dynamic addresses change hands, and a listing can be old. Treat it as confirmation when you already have other reasons to be suspicious, not as the sole basis for blocking someone.
What data leaves my site when I run a lookup?
Only the address or domain you type. Geolocation goes through ip-api.com, AS data through BGPView with RIPEstat as a fallback, and the shared-hosting count through HackerTarget. No content from your site and no data about your visitors is sent anywhere.
Results are cached for six hours, so looking up the same address twice costs one request rather than two. The map library ships inside the plugin: only the tiles come from OpenStreetMap, and no third-party script is loaded into your dashboard.
Can I block an address straight from the results?
Yes. Every address appearing in the activity log or the security screen opens the lookup already filled in, and next to it sits a Block button that adds it to the blocklist without reloading the page.
If the address is already on the allowlist the button doesn’t appear at all: the allowlist takes priority, so blocking would have no effect and showing the button would be a false promise. Every lookup requires the capability to manage site options and a valid nonce.