sourcecode347

The Anti Browser DDoS Protection plugin provides robust protection against denial-of-service (DoS) attacks on your WordPress site. It implements IP-based rate limiting, with configurable settings for subscribers, non-logged-in users, and verified bots, while excluding administrators and other non-subscriber roles. It features advanced bot detection to identify and limit suspicious bots, immediate blocking of malicious bots by User Agent, and supports Cloudflare for accurate client IP detection. Static assets (e.g., CSS, JS, images) are excluded to maintain site performance. An intuitive admin panel allows you to configure rate limits, bot exclusions, trusted bot IP ranges (with automatic duplicate removal), blocked bots by User Agent, log expiration settings, and view logs for blocked IPs, banned IPs, and high traffic bots with auto-refresh every 30 seconds, all with User Agent details and timestamps. You can export Excluded Bots, Bot IP Ranges, and Blocked Bots lists to .txt files and import new entries to append to existing lists without duplicates. Daily bar charts for Blocked IPs, Banned IPs, and High Traffic Bots are displayed above the logs for quick visual insights.
Key Features:
<ul>
<li>Rate limiting based on IP for subscribers and non-logged-in users, with configurable maximum requests and time window.</li>
<li>Excludes non-subscriber logged-in users (e.g., administrators, editors) from rate limiting.</li>
<li>Advanced bot detection to identify suspicious bots (bots using trusted User Agents but from unverified IPs).</li>
<li>Suspicious bots are subject to the same rate limiting as regular users and logged with User Agent in the Blocked IPs Log.</li>
<li>Immediate blocking of malicious bots by User Agent (e.g., MJ12bot, SemrushBot, DotBot by default) with customizable settings and logging.</li>
<li>Configurable rate limiting for verified excluded bots (default: 100 requests per minute), with logging for bots exceeding this limit.</li>
<li>High Traffic Excluded Bots Log to track verified bots with excessive requests, including IP, User Agent, and timestamp.</li>
<li>Admin panel to configure maximum requests, time window, excluded bots, trusted bot IP ranges, blocked bots (User Agents), blocks before ban, ban duration, high traffic bot limits, and log expiration (days).</li>
<li>Export Excluded Bots, Bot IP Ranges, and Blocked Bots lists to .txt files for backup or transfer.</li>
<li>Import .txt files for Excluded Bots, Bot IP Ranges, and Blocked Bots to append new entries to existing lists, with automatic duplicate removal.</li>
<li>Automatic removal of duplicate IP ranges in the Bot IP Ranges field on save, keeping the first occurrence.</li>
<li>Support for Cloudflare real IP detection using <code>CF-Connecting-IP</code> and <code>X-Forwarded-For</code> headers.</li>
<li>Excludes static assets (CSS, JS, images, fonts, etc.) from rate limiting to optimize performance.</li>
<li>Logs blocked IPs, banned IPs, and high traffic bots with IP, User Agent, and timestamps using the WordPress timezone, viewable in the admin panel with options to clear logs and auto-refresh every 30 seconds.</li>
<li>Daily bar charts for Blocked IPs, Banned IPs, and High Traffic Bots displayed above the logs in the admin panel for visual statistics.</li>
<li>Automatic log expiration (Blocked IPs, Banned IPs, High Traffic Bots) after a configurable number of days (default: 5 days), with hourly cleanup via WordPress Scheduler.</li>
<li>All error messages and logs prefixed with “Anti Browser DDoS Protection: ” for clarity.</li>
<li>Donate link in the admin panel to support the project.</li>
<li>Automatic cleanup of transients, blocked IPs, banned IPs, high traffic bots, blocked bots, bot IP ranges, and log expiration settings on plugin deactivation to prevent database bloat.</li>
</ul>
Ideal for WordPress sites seeking enhanced security against automated attacks, with seamless integration for Cloudflare users, advanced bot management, efficient log management, visual charts for statistics, and easy export/import for bot lists.
<h3>Plugin Assets img/</h3>
<h3>Icon Image</h3>
Normal: icon-128×128.png 
High-DPI (Retina): icon-256×256.png
<h3>Bugs</h3>
Caching plugins such as WP Super Cache, W3 Total Cache, and others may bypass the DDoS protection provided by Anti Browser DDoS Protection, serving cached pages without triggering the plugin’s checks for blocked bots, rate limiting, or banned IPs. 
– Solution: Disable all WordPress caching plugins to ensure full DDoS protection. Instead, enable Browser Caching using a service like Cloudflare to improve performance without compromising security. 
 Enable standard type Caching and Configure Cloudflare Browser Cache TTL (e.g., 8 days) via Caching > Configuration in the Cloudflare dashboard.- Cloudflare Compatibility: Ensure Cloudflare is configured to pass <code>CF-Connecting-IP</code> headers for accurate IP detection. Check your Cloudflare dashboard if logged IPs are incorrect. 
– Bot IP Ranges: Update the Bot IP Ranges field every 6 months (next update: March 2026) using official sources (e.g., Google, Bing, Yandex documentation). Duplicate ranges are automatically removed on save. Export to .txt for backup or import from .txt to append new ranges. 
– Blocked Bots: Add malicious bots to the Blocked Bots (User Agents) field (e.g., MJ12bot, SemrushBot, DotBot) to block them immediately. Blocked bots are logged with their IP and User Agent. Export to .txt for backup or import from .txt to append new entries. 
– Excluded Bots: Add trusted bots (e.g., Googlebot, Bingbot) to the Excluded Bots field to exempt them from regular rate limiting (if from verified IPs). Export to .txt for backup or import from .txt to append new entries. 
– High Traffic Bots: Verified bots exceeding the configured limit (default: 100 requests per minute) are logged for monitoring but not blocked. Check the High Traffic Excluded Bots Log regularly. 
– Log Expiration: Set the Log Expires (Days) setting to control how long logs are retained (default: 5 days). Cleanup runs hourly via WordPress Scheduler. Logs older than the specified days are automatically deleted. 
– Timezone: Set the WordPress timezone correctly (e.g., <code>Europe/Athens</code> for Greece) in Settings > General > Timezone to ensure accurate timestamp display in logs and charts. 
– Performance: For high-traffic sites, clear the Blocked IPs Log, Banned IPs Log, and High Traffic Excluded Bots Log regularly, or set a lower Log Expires (Days) value to prevent database growth. 
– Customization: Contact the author for additional features like custom error pages, email notifications for high traffic bots, or advanced logging. 
– Support the Project: If you find this plugin useful, consider supporting its development via the <a href="https://buy.stripe.com/bIY5o70SSfam8Qo7ss" rel="nofollow ugc">donation link</a> in the admin panel or plugin page.

Anti Browser DDoS Protection


I hope it helps Wordpress users protect themselves from DDoS attacks, it also protects you from Javascript Based DDoS Attacks that exploit the Subresource Integrity (SRI) vulnerability, from which neither Crowdsec, nor Mod_Evasive, nor IP_Tables Rules nor Cloudflare protect you.I struggled until I fortified my page and I have all the above services enabled, finally I succeeded by creating this Wordpress Security Plugin.I am very satisfied that I made it available for other users to use completely free of charge, it is open source software with License GPL 2.0.


It also protects you from Javascript Based DDoS Attacks

Protects WordPress from DDoS with rate limiting, bot detection, blocking, Cloudflare support, logs, charts, and bot list export/import.

wedos.com

Our WordPress plugin has a full site caching feature, a CDN Cache feature, and optional settings for the sending of security reports. Furthermore, it serves as a tool for easy activation of the WEDOS Global Protection service.
<h3>WEDOS Global (CDN Cache & Security)</h3>
<h3>Local WordPress Cache</h3>
The WEDOS Local WordPress Cache stores your WordPress pages and content as static files which it later serves to your website visitors, thus saving the load on the web server, while also simultaneously reducing the website loading times. Utilise the local caching feature, which can be activated without any registration, and always stay close to your local WordPress website visitors.
<h3>Security Reports</h3>
Have security reports sent to you, and get information about cyberattacks and threats, as well as tips for improving your website. You can customise the reports according to your needs. You can also get useful news, tips, and recommendations for improving the overall health of your website.
<h3>Global WordPress Cache</h3>
The WEDOS Global CDN will ensure a significant increase of your WordPress loading speed, and better overall server response all around the world. This will result in improved user experience (UX), higher rankings in search results, more orders, or leads, and returning customers. Maximalising the performance of your website can help to improve its conversion rate even by up to a few percent!
How does the Global WordPress Cache speed up your website?
<ul>
<li>Static web pages and their parts will be stored on our servers all over the world, always as close to your visitors as possible. Our global server infrastructure currently entails 120 data centres, covering all continents (except Antarctica).</li>
<li>Thanks to the Anycast DNS technology, all DNS requests will be served from the nearest point to the request, which encompasses all types of requests, not only for the website, but also e.g. the mail server, FTP, etc.</li>
<li>By filtering out harmful traffic, and blocking hazardous cyberattacks, our global network also provides website protection. Harmful traffic makes up up to 60% of a regular WordPress website, and bots searching for vulnerabilities are usually the reason of website slowdowns, or outages even.</li>
</ul>
The WEDOS Global (CDN Cache & Security) plugin connects your website with the WEDOS Global infrastructure, providing not only high-performance protection against a vast variety of cyberattacks, but also website speed optimisation. The infrastructure is built on thousands of physical servers, strategically placed in dozens of locations worldwide with the overall connectivity of 3,000 Gbps, ensuring not only enhanced security, and stability of your website, but also ultra-fast loading times.
<h3>Cloud WAF</h3>
By filtering traffic, and blocking harmful cyberattacks on the cloud servers, our cloud WAF (Web Application Firewall) provides protection for your WordPress websites without putting any extra load on your local resources. The protection is ensured by the use of advanced security technologies, continuous monitoring of all traffic, and data analysis of hundreds of thousands of websites.
The WEDOS Cloud WAF protects your website against attempts at cracking passwords or finding vulnerabilities because it can safely distinguish whether there is an attack attempt taking place, and in that case, put those requests through a test, which can be solved by the browser for the real users, meanwhile denying access to harmful bots.
Situated on our own servers, our WAF works outside your WordPress (hosting service), so it does not put any extra load on your web server. This means that all traffic coming to your website is scanned by our WAF, even before it reaches your website. This level of protection entails blocking harmful website visits (from harmful bots), and attacks, like e.g. attempts at system breakthroughs, or hazardous scripts, without affecting the real users, or search engine bots coming to your website.
<h3>What is in it for you?</h3>
Thousands of servers, global coverage, CDN Cache: Utilise our worldwide infrastructure which distributes the load on servers, and reduces website loading times, regardless of the current location of your website visitors. Our servers will serve as a global CDN Cache for your website.
Improving your website’s overall SEO score and user experience (UX): A fast, high-performance infrastructure positively impacts your website’s SEO score, its rankings in search results, and improves the overall user experience for your visitors. Thanks to direct connections with local internet exchange points (IXPs), your data is always as close to your visitors as possible. We have a direct connection set up with most of our most significant connectivity providers.
Anycast DNS: Your WordPress will promptly answer website requests, from the first request for the domain (DNS) to repeated answers, where we will serve static content directly from our servers at the location of your website visitors.
Instant access to recent technologies: Using our plugin, your website will automatically gain access to the most recent internet technologies, and security standards, like e.g. IPv6 and HTTP/3 support, even if your current hosting provider does not support those new technological advances.
Stability and support: Our cybersecurity specialists, and our technical and customer support are there for you 24 hours a day, 7 days a week, to ensure incident-free operation, and non-stop protection for your website.
Privacy and data protection: Your data safety is a number one priority for us. Our plugin is designed to protect your data and privacy, in accordance with the most recent standards, and adheres to all EU requirements concerning GDPR. The WEDOS company is also a proud ISO certifications owner, and holds the ISO 9001 (Quality Management System), ISO 27001 (Information Security Management System), ISO 27017 (Code of practice for information security controls for cloud services), and ISO 27018 (Code of practice for protection of personally identifiable information in public clouds acting as PII processors) which ensure the quality of our services, and their reliability, guaranteed by an independent certification authority.
Become a part of a global network: By installing the WEDOS Global (CDN Cache & Security) plugin, you increase the performance, and security of your website, as well as connect with an innovative global network that continuously challenges the limits of utter possibilities of the digital world.
<h3>Links to Documentation and Other Sources</h3>
<ul>
<li><a href="https://www.wedos.com/protection/" rel="nofollow ugc">WEDOS Global</a></li>
<li><a href="https://kb.wedos.com/en/kategorie/wedos-global-en/" rel="nofollow ugc">Knowledge Base</a></li>
<li><a href="https://help.wedos.com" rel="nofollow ugc">Community Help</a></li>
</ul>

WEDOS Global (CDN Cache & Security)

Our WordPress plugin has a full site caching feature, a CDN Cache feature, and optional settings for the sending of security reports.

Anti Browser DDoS Protection vs WEDOS Global (CDN Cache & Security)