@cPFence Is there a command to automatically delete the cPFence plugin from all websites?
Regardless of this, here are a few thoughts on the plugin:
I think that the use of the plugin is not GDPR-compliant at the moment, as the recorded IP addresses are not anonymized.
The stored transients are only valid for 5 minutes, but they still remain in the database.
What I don't quite like is that jQuery is forced to be loaded in the frontend. I think this has less to do in a security plugin and should be my own decision whether I want jQuery in the frontend or not.
I see that cPFence relies on jQuery, but I think you can do the same with vanilla JavaScript. Or jQuery should only be loaded in the frontend when a user is logged in, as is done with the cPFence inline script.
But it would be best to do without jQuery completely.
I don't know about most of the others here, but I'm a bit conflicted about the cPFence plugin. On the one hand, I welcome the commitment to the community, but on the other hand, there are already very good plugins that can do exactly that and much more than the cPFence plugin currently does. NinjaFirewall, for example, is one such plugin.
In addition, we do not want to have a “vendor lock-in effect” for our customers. Although the cPFence plugin works on its own, without cPFence being installed on the server, it still gives the impression of a vendor lock-in effect because it is not a plugin that is freely available.
It would perhaps be much better if the plugin were made public in the WordPress plugin directory. This would give cPFence a greater reach, which is certainly the goal, and users would be assured that this is an official plugin that has been reviewed by WordPress.
But again, I'm not sure if it makes sense to put your resources into a WP plugin.
I will continue to use cPFence because it is really good and makes my day-to-day work much easier and will certainly get even better in the future. But I will probably not use the plugin (for the time being) and rely on NinjaFirewall instead.
