BotBlocker Security – Complete security platform
BotBlocker Security is a complete security platform that blocks 99% of attacks before WordPress loads. Firewall, bot detection, rate limiting, CAPTCHA, 2FA, analytics, notifications, tools – one plugin replaces your entire security stack: no need for separate firewall, CAPTCHA, 2FA, and anti-spam pl
BotBlocker Security is a complete security platform that blocks 99% of attacks before WordPress loads. Firewall, bot detection, rate limiting, CAPTCHA, 2FA, analytics, notifications, tools – one plugin replaces your entire security stack: no need for separate firewall, CAPTCHA, 2FA, and anti-spam plugins. No bloat, no monthly fees for core protection.
If your site is hit by login brute force, spam comments, fake Googlebots, content scrapers, or XML-RPC floods, you are not alone: bots generate over 47% of all web traffic. Most security plugins react after WordPress boots, wasting CPU and memory on every bad request. BotBlocker stops them at the door – then gives you the analytics, alerts, and tools to understand exactly what it blocked and why.
Because BotBlocker intercepts traffic before themes and plugins run, it also shields vulnerabilities in your entire plugin and theme stack. Zero-days in contact form plugins, unpatched slider code, outdated e-commerce extensions – attackers never reach the vulnerable code. BotBlocker is your first and last line of defense, every day.
Why site owners switch to BotBlocker
- Faster than the competition. Runs on early init through three interception layers, before themes and plugins load. Server load drops during attacks instead of spiking. Zero database queries for returning visitors – pre-generated PHP files with SHA-256 integrity, loaded via native include .
- One plugin, full security stack. Firewall, CAPTCHA, 2FA, anti-spam, rate limiting, bot detection – BotBlocker covers virtually every security need a WordPress site has. Most users uninstall 2-3 separate plugins after switching. PRO adds malware scanning, security headers, speed optimization, and behavioral analysis – still one plugin.
- Smarter bot detection. User-Agent signatures (largest blacklist among WordPress plugins) plus additional bot signatures. Header checks including AdBlock detection, incognito mode detection, Canvas/WebGL fingerprinting, and device API verification. Anti-detect scoring with weighted signals catches headless Chrome, Puppeteer, Selenium, and PhantomJS even when they spoof user-agent strings.
- Smarter CAPTCHA. Multiple modes including Silent Auto-Verify – zero clicks for humans, hard wall for bots. Proprietary CAPTCHAs defeat AI-based solvers that crack reCAPTCHA for $2-3 per 1,000.
- Honest free version. Full firewall, all CAPTCHA modes, full 2FA, full logging, full Multisite, Redis/Memcached, shortcodes, command palette, Telegram alerts, visual analytics, diagnostic tools. No nag screens, no crippled features.
- Privacy-first. No visitor data leaves your server. GDPR and CCPA compliant out of the box.
- Works with everything. Cloudflare, WP Rocket, LiteSpeed, WooCommerce, Elementor, multisite, IPv6, PHP 7.4 to 8.5.
🛡️ Core Firewall (Free)
- Three-Layer Architecture – intercepts traffic at wp-config.php (before WordPress), MU-plugin phase, and main shield. Known threats are blocked before WordPress, plugins, or themes load – saving 30-100ms and 5-20MB RAM per blocked request. Zero-day attacks on other plugins never reach the vulnerable code.
- Web Application Firewall (WAF) with real-time rule updates via the BotBlocker Threat Defense Feed
- User-Agent + additional bot signatures – largest blacklist among WordPress plugins, covering Scrapy, Selenium, Puppeteer, PhantomJS, curl, wget, Python, Java, Perl, SQL injection tools
- Brute force protection with progressive lockouts – 5 attempts per 15 minutes, escalating bans
- Rate Limiting – sliding window velocity per IP. 30 req/min triggers CAPTCHA; 50/min blocks IP for 10 min. Subnet aggregation catches distributed attacks. Floor protection prevents false positives.
- Anti-spam for comments, registration, contact forms
- XML-RPC and REST API locked down by default with allowlist for trusted services
- HTTP method-level hardening – CONNECT and TRACE blocked (XST attack prevention). OPTIONS handled for CORS preflight.
- Fake crawler detection via FCrDNS (dual-direction DNS verification), ASN tokens, and published IP ranges – 95% effective, impossible to spoof without controlling the provider’s DNS zone.
- LLM / AI crawler management – allow or block GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Bytespider via CIDR-verified IP ranges (1,435 synced from cloud).
- Country, ASN, IP range, User-Agent, Referer blocking rules with instant enforcement. ASN database: 3.6M verified records. Geo-blocking with visual country selector and import/export.
- Cloudflare-aware real-IP resolution and origin bypass protection
- TLS fingerprinting (JA3/JA4) – detects bots by TLS handshake signature, cross-validates against User-Agent. Opt-in, requires server module.
- RKN (Roskomnadzor) blocking – 852 CIDR ranges, cloud-synced, auto-updated with self-healing tamper recovery
- Full IPv6 support – separate tables and logic for IPv4 and IPv6
- Live traffic monitor with attack map, country, ASN, device, browser, block reason
- Built-in caching via Redis and Memcached – free, auto-disable on connection failure
🔍 Bot Detection & Anti-Detect (Free)
13 HTTP header checks run on every visitor, catching bots others miss:
- Empty User-Agent / UA Anomalies / Empty Accept-Language
- PTR/DNS Mismatch – forward/reverse DNS mismatch, impossible to fake
- Geo vs Language Mismatch – language claimed differs from visitor’s country
- Incognito/Private Mode detection
- AdBlock/uBlock detection in visitor’s browser
- Canvas & WebGL Fingerprinting – JS consistency verification
- WhatsApp Preview / OPTIONS Preflight – legitimate traffic whitelisted
Anti-Detect Challenge Page activates when header checks raise suspicion – silent browser fingerprinting before any CAPTCHA appears:
- 9 weighted signals: navigator (×2), fake plugins (×3), font rendering (×2), WebGL (×2), Chromium properties (×3), JS jitter, touch events (×2), language (×3), incognito (×2)
- Critical signal combinations trigger immediate block
- Cookie capability test + sessionStorage retry counter
- HMAC-signed responses resist DDoS provider interference
- Circuit Breaker: 3 failures → 30-second cooldown → auto-retry
- CAPTCHA appears only if auto-verification fails
🎯 CAPTCHA System – All Modes Free
CAPTCHA modes, all free: Silent Auto-Verify (recommended – zero clicks, silent JS fingerprint check), Simple Button, Color Buttons, Image CAPTCHA (Eagle, Horse, Raccoon, Dog, Cat packs), reCAPTCHA v2 (+ Button), Dynamic Shapes (60fps Canvas), Dynamic Digits, Hold Button (hold in the green zone).
- Hybrid Mode – internal CAPTCHA + invisible reCAPTCHA v3, two-layer defense
- DDoS Resilience Mode – HMAC-signed responses prevent forged challenge bypass
- Session Token Verification – cookie-less fingerprint for restricted hosting
- CAPTCHA Diagnostics – failure reason codes (token decrypt, transient, hash, mode mismatch)
- Image Delivery: Inline Base64 (single request, recommended) or Separate Requests (cache-friendly)
🔒 Login Security & 2FA (Free)
- Two-Factor Authentication (Google Authenticator, Authy, 1Password, Bitwarden) – TOTP, 10 backup codes
- CAPTCHA modes on login, registration, lost password, and custom forms
- Hybrid Mode – internal CAPTCHA + reCAPTCHA v3 two-layer invisible defense on login
- Hide login URL (PRO)
- Configurable lockout escalation – failed CAPTCHA = short ban, repeat = 24-hour ban
💳 Payment Gateway Bypass (Free)
Auto-detects 25+ e-commerce platforms (WooCommerce, Easy Digital Downloads, SureCart, MemberPress, Paid Memberships Pro, Give, Dokan, CartFlows, FunnelKit and more) and 150+ payment providers (Stripe, PayPal, Mollie, Adyen, Braintree, Square, Razorpay, Klarna, Paddle, Authorize.Net, YooKassa, LiqPay and more), plus form plugin webhooks (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Fluent Forms).
Detection layers – path patterns, query keys, action names, signature headers – ensure zero false positives. Webhooks, IPN callbacks, and payment notifications never get blocked.
📊 Visibility & Control (Free)
- Visual dashboard – KPI cards (Requests, Blocked, Search engines passed, Protection score), hourly bar chart, donut charts (Hosting, Device, Browser, OS)
- Dashboard social proof card – live WordPress.org rating, installs count, ratings, link to WP.org (cached 12h)
- Inline IP rule widget – add IP allow/block rules via AJAX. Bulk import with 4 one-click buttons (IPv4/IPv6 whitelist/blacklist)
- Protection Status Checklist – per-feature toggles with “Enable remaining” bulk action
- Health Score gauge – parameters across categories, levels from Critical (<25) to Secure (≥85), real-time updates
- 3 security presets – Light, Strong, Full – one-click configuration. Plus Default for new installs
- Setup Wizard – under 5 minutes, including Google reCAPTCHA setup
- ⌘K Command Palette – Ctrl+K / ⌘K on any admin page to search every setting, tab, and action. 30+ quick-action shortcuts. Near-zero-click configuration
- Interactive analytics – 8 KPI metrics, donut charts, traffic line chart, world map, top IPs and countries rankings
- 55 diagnostic event codes across 12 log categories – exact block reason for every decision
- Detailed event log – IP, country, ASN, User-Agent, browser, OS, device, exact block reason
- 17 interface languages – English, Deutsch, Español, Français, Polski, Русский, Українська, العربية, עברית, Italiano, 日本語, 한국어, Nederlands, Português, Svenska, Türkçe, 中文 + POT
- Admin page header bar – “Blocked today: X · Total: Y” on every admin page
- Admin bar toolbar node – protection status + Dashboard + Settings links
- Configurable retention with timezone/DST awareness, Daily Summary with incremental aggregation
- X-Robots-Tag control – SEO directives (noindex, nofollow, noarchive, nosnippet, noimageindex, notranslate, unavailable_after) on every page BotBlocker lets through; block and challenge pages always carry noindex – no search engine indexing of security barriers
- Clean uninstall – drops all database tables, options, transients, cron hooks, MU-plugin files, uploads/botblocker/. Departure feedback dialog. Zero leftover data
📬 Notifications & Alerts (Free)
- Email reports – daily / twice-weekly / monthly security summar
Screenshots & previews.
60-second setup
- 01In WordPress admin, go to Plugins → Add New and search for “BotBlocker Security”
- 02Click Install Now , then Activate
- 03Open BotBlocker in the admin menu and follow the Setup Wizard with compatibility test and Google reCAPTCHA setup
Default settings protect most sites immediately. For advanced configuration, three security presets (Light / Strong / Full) give you one-click protection tuned to your needs.
Frequently asked questions.
Is BotBlocker Security really free?
Yes. The free version includes: three-layer firewall, all CAPTCHA modes, anti-detect scoring, FCrDNS bot verification, rate limiting, 2FA with backup codes, anti-spam, brute-force protection, XML-RPC and REST API protection, live traffic monitor, Telegram alerts, shortcodes, diagnostic tools, command palette, Redis/Memcached, Multisite support, and DDoS compatibility. PRO adds cloud threat intelligence, Early Init Mode, premium addons (Hide Login, Security Headers, Speed Up, Malware Scanner, Behavioral Analysis, and more), and priority support. Premium starts at $12/month.
Will it slow down my site?
No. Measured overhead is +3-15ms for verified visitors with zero database queries – all rules load from pre-generated PHP files with SHA-256 integrity. Under attack, server load typically drops because bad requests are rejected at the earliest interception layer, before WordPress, PHP, or database code runs. FULL mode saves 30-100ms and 5-20MB RAM per blocked request.
Does it work with Cloudflare or a CDN?
Yes. BotBlocker reads proxy headers (CF-Connecting-IP, X-Forwarded-For, X-Real-IP) to find the real client IP and blocks attempts to bypass Cloudflare by hitting your origin directly. Fully compatible with Cloudflare, Sucuri, Incapsula, AWS CloudFront, Fastly, KeyCDN, and StackPath.
Cloudflare Business+ users can also enable TLS fingerprinting (JA3/JA4) for bot detection – see docs/TLS-FINGERPRINTING.md .
Does it work with WooCommerce and payment gateways?
Yes. Auto-detection for e-commerce platforms and payment providers. Stripe, PayPal, Mollie, Adyen, Razorpay, YooKassa, and other webhooks are automatically recognized and never blocked. Detection layers (path patterns, query keys, action names, signature headers) ensure zero interference with payment processing. Bypass modes (full/partial), settings and hardening recommendations: see docs/PAYMENT-BYPASS.md .
Does it work with caching plugins?
Yes. BotBlocker automatically sets DONOTCACHEPAGE and multiple cache-bypass headers ( Cache-Control: no-store , X-LiteSpeed-Cache-Control , X-Accel-Expires , CDN-Cache-Control , Surrogate-Control ) on verification pages so PHP-based caches, Nginx reverse proxies, CDN edges, and surrogate caches never store security barriers. Works out of the box with WP Super Cache (PHP mode), W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, WP Fastest Cache, Cache Enabler, and Swift Performance. Server-level caches (Nginx FastCGI, Varnish) need a cookie-based bypass rule – see docs/CACHE-COMPATIBILITY.md .
Does it work behind DDoS-Guard, Stormwall, or similar services?
Yes. Since version 1.6.13, BotBlocker auto-detects JS-challenges from external DDoS protection services. HMAC-signed AJAX responses let the plugin distinguish its own responses from DDoS-provider challenge pages. Circuit Breaker prevents retry storms (3 failures → 30-second cooldown). BotBlocker is the only WordPress security plugin that works correctly behind aggressive DDoS protection without manual whitelisting. See docs/DDOS-COMPATIBILITY.md .
Will it lock me out?
No. BotBlocker auto-detects your server IP during setup and lets you allowlist admin IPs and trusted services. WP-Cron and internal WordPress calls always pass. If you ever get locked out, a hashed Secret URL (generated in the admin panel and sent to the admin email) provides emergency access – no FTP required.
Does it collect visitor data?
No. Only technical request parameters (IP, headers, User-Agent) are analyzed locally on your server. No PII is stored or sent anywhere. GDPR-compliant under Legitimate Interest (Art. 6(1)(f)). CCPA compliant – no PII collection, no data sale. Full details in docs/PRIVACY.md .
Does it support IPv6?
Yes. Every feature works with IPv4, IPv6, or dual-stack setups. Separate database tables and logic for each protocol family.
Does it support multisite?
Yes, since version 1.6.15. Network activation, per-site data isolation, per-site settings, and per-site cleanup on uninstall. Free on all plans.
Will it conflict with Wordfence, Sucuri, or other security plugins?
BotBlocker is designed to coexist. It operates very early in the request lifecycle and typically works alongside other plugins. The only thing to avoid is enabling the same CAPTCHA twice on the same form. Most users replace their previous security stack entirely.
Which CAPTCHA should I choose?
Silent Auto-Verify is the recommended default. Real users pass with zero clicks via JavaScript fingerprint checks behind the scenes – they see nothing. Bots see “Access denied.” For login pages, combine Silent Mode with reCAPTCHA v3 in Hybrid Mode for two-layer invisible defense. Shapes CAPTCHA (60fps Canvas with moving geometric figures) is the strongest against AI-based CAPTCHA solvers – it requires real-time computer vision, making it roughly 100x more expensive to crack than standard reCAPTCHA.
How does BotBlocker verify search engine bots?
Through FCrDNS (Forward-confirmed Reverse DNS) – the same method used by Cloudflare Bot Management, DataDome, and Akamai Bot Manager. Googlebot is verified via PTR (.googlebot.com) + ASN (15169). YandexBot uses triple verification (PTR + ASN 13238 + IP CIDR). Facebook gets dual verification (PTR + ASN 32934). Multi-resolver DNS fallback for reliability. 95% effective against fake crawlers – you cannot spoof FCrDNS without controlling the provider’s DNS zone.
Does BotBlocker use honeypots?
Yes – several kinds, layered at different levels:
- Challenge page decoys. CAPTCHA modes render invisible decoy buttons with generated class names and styles ( display:none on random per-request hashes). Clicking a decoy submits a wrong challenge hash and the request is rejected. Decoys are re-generated per request, so bot patterns cannot be hardcoded.
- Hidden autofill trap. The check page contains a CSS-hidden text input with a rotating per-request name (salt + time hash). Blind automation that fills every form field trips the trap and is rejected server-side before any token is verified.
- Submit-timing signal. The page records load time and reports the submit delta; sub-300ms submissions (without human interaction time) are rejected. Disabled in Silent Auto-Verify mode, where legitimate browsers submit immediately.
- Challenge token layer. Every CAPTCHA mode uses a signed challenge nonce + answer hash; any wrong, stale, or forged token fails verification regardless of the honeypots above.
The server-side honeypot validation runs in both protection modes (FULL and FRONTEND) and on both verification endpoints (AJAX verification and the /bbcs-verify/ endpoint), before any cookie or token is issued.
Can I block AI crawlers (ChatGPT, Claude, Perplexity)?
Yes. GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-SearchBot, and PerplexityBot are verified via 1,435 CIDR ranges synced from the cloud API. You can allow or block each provider independently. Bytespider (ByteDance) is verified via PTR (.bytedance.com). Trusted AI crawlers pass; impersonators are blocked.
Can I get Telegram notifications?
Yes. Free. Connect a Telegram bot via @BotFather, then open Add-ons → Telegram Notifications and enter the Bot Token and Chat ID. You’ll receive weekly security summaries: total requests, allowed, blocked, suspicious, search bots, fake bots, plus timezone, protection mode, security score, and block rate. A connection test button verifies setup instantly.
Can I display security stats on the frontend of my site?
Yes. Shortcodes let you embed counters, charts, health gauges, top IPs/countries, system status, and more on any page. Perfect for client dashboards, status pages, and public security transparency reports.
What is the Health Score?
A 44-parameter security assessment displayed as a visual gauge (0-100). Five levels: Critical (<25), Weak (25-49), Moderate (50-69), Strong (70-84), Secure (≥85). Three categories weighted: core protection (75%), cloud extended (25%), neutral indicators. The score updates in real-time as you change settings – a built-in guide to improving your site’s security posture.
Does the PRO version include a trial?
No traditional trial. Instead, the free version includes the full firewall, all CAPTCHA modes, anti-detect scoring, rate limiting, FCrDNS verification, 2FA, Multisite, Redis/Memcached, Telegram alerts, shortcodes, and live traffic monitoring – enough to protect most sites permanently. A limited-time Premium promo (14 days, no credit card) is available inside the plugin to try cloud features. PRO plans start at $12/month with a 30-day refund policy.
What happens when I delete the plugin?
Clean uninstall: all database tables are dropped, WordPress options deleted, transients cleared, cron hooks removed, MU-plugin files cleaned, and the uploads/botblocker/ directory deleted. On multisite, per-site cleanup runs in batches of 50. Uninstall feedback dialog collects your reason for leaving. Zero leftover data – no orphaned rows, no stale cron jobs.
Is my visitors’ data collected or stored?
No. BotBlocker Security does not collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.
Where can I find documentation and support?
Product site: https://botblocker.top/products/ Pricing and PRO plans: https://botblocker.top/pricing/ Documentation: https://docs.botblocker.top/#/en/README Contact/support: https://botblocker.top/contacts/ Community: https://botblocker.top/community/
What license is BotBlocker Security under?
GPLv2 or later. See LICENSE.txt for details.
Who develops BotBlocker Security?
Developed and maintained by GLOBUS.studio. Concept, architecture & code – Yevhen Leonidov ( https://leonidov.dev/ ). Code, code review – Andrii Lukashevych. Code, translations – Aleksandr Kinakh.
Where can I find the glossary?
New to website security? The words BotBlocker uses, in plain language, are in the glossary .
