Yevhen Leonidov

Aleksander Kinakh

Andrii Lukashevych

<h4>WordPress Security Plugin & Firewall (WAF)</h4>
<p><strong>Every day, automated bots and hackers bombard websites with attacks.</strong> Mass botnets, fake search engine crawlers, brute-force login attempts, and spam bots can overwhelm your WordPress site – stealing data, overloading your server, and defacing content. It’s a 24/7 threat to your business. If you’re looking for <strong>WordPress site protection</strong>, you need a proactive defense that stops these attacks before they reach your website.</p>
<p><strong>BotBlocker Security is the all-in-one solution to keep your site safe from automated threats.</strong> This powerful <strong>WordPress security plugin and Web Application Firewall (WAF)</strong> acts as a dedicated <strong>anti-bot</strong> firewall, blocking malicious traffic at the front gate without slowing down your site.</p>
<p>BotBlocker’s setup and onboarding experience allows anyone to secure their <strong>WordPress site</strong> in under 1 minute, regardless of technical expertise. You can rest assured knowing you have enabled the right <strong>site protection</strong> settings to protect your website.</p>
<h4>🔥 WordPress Firewall (WAF)</h4>
<p>BotBlocker Security includes an endpoint <strong>firewall/WAF</strong> that identifies and blocks malicious traffic before it reaches WordPress. Built and maintained by a team focused 100% on WordPress security, our Web Application Firewall protects your site while reducing server load.</p>
<p><strong>BotBlocker intercepts bad traffic at the earliest stage</strong> – even before WordPress or your theme loads. By running as a must-use plugin (MU-plugin) on early init, it blocks threats before WordPress initializes, drastically reducing server load during attacks.</p>
<p><strong>Key Firewall Features:</strong></p>
<ul>
<li>Real-time firewall rule updates via the BotBlocker Threat Defense Feed</li>
<li>Real-time IP Blocklist blocks all requests from the most malicious IPs</li>
<li>Early-init protection – blocks threats before WordPress loads</li>
<li>Cloud-based threat intelligence – cross-checks every visitor against global threat databases</li>
<li>No visitor data collected – only technical request parameters analyzed (GDPR/CCPA-compliant)</li>
<li>Brute force protection with login attempt limits and multi-layer verification</li>
</ul>
<h4>📡 WordPress Security Scanner & Site Protection</h4>
<p>Every attempt to access your site is thoroughly analyzed and filtered. BotBlocker provides comprehensive <strong>site protection</strong> across all entry points:</p>
<ul>
<li><strong>XML-RPC and API Protection</strong> – all endpoints blocked by default. Create access rules for trusted services and add allowed URLs for payment plugins</li>
<li><strong>Spam Prevention</strong> – spammers cannot connect to your site. Automatically block IP addresses that exceed spam comment thresholds</li>
<li><strong>File Access Protection</strong> – theme and plugin files securely protected from unauthorized access</li>
<li><strong>Deep Analysis</strong> – User-Agent, Accept-Language, GeoIP, PTR, DNSBL, cookies, browser fingerprint, AdBlock, Incognito detection</li>
<li><strong>Network & Protocol Control</strong> – block obsolete HTTP/1.0 clients and disable IPv6 if not used. Cloudflare-aware protection blocks origin bypass attempts</li>
</ul>
<h4>🔒 Login Security & 2FA</h4>
<p>All login attempts pass through multi-layer filtering and CAPTCHA verification:</p>
<ul>
<li><strong>Two-Factor Authentication Support</strong> – 2FA enhanced login security for admin area. Backup codes for recovery access. Universal 2FA app support – works with Google Authenticator, Authy, etc.</li>
<li><strong>Multi-layer CAPTCHA Protection</strong> – color buttons, animal images, floating shapes, floating math, Google reCAPTCHA v2/v3, and more. Any internal CAPTCHA can be combined with reCAPTCHA v3 for dual-layer protection</li>
<li><strong>Brute Force Protection</strong> – configurable login attempt limits. Failed attempts trigger temporary bans, with escalating penalties for repeated failures</li>
<li><strong>Advanced Anti-bot Challenges</strong> – proprietary CAPTCHA designed to be nearly impossible to bypass, even by AI-based anti-CAPTCHA services</li>
<li><strong>Intelligent Ban System</strong> – failed CAPTCHA results in configurable ban periods. Repeated failures trigger 24-hour bans</li>
<li><strong>Admin Access Simplification</strong> – special mechanism to ease site administrator login while maintaining security</li>
<li><strong>XML-RPC Control</strong> – options including complete disabling</li>
</ul>
<h4>🛠️ Security Tools</h4>
<p>Comprehensive tools to block attackers and monitor your site in real-time:</p>
<ul>
<li><strong>Advanced Blocking Rules</strong> – block by IP or build rules based on IP Range, Hostname, User Agent, Referrer, PTR record, ASN, country, city, and more</li>
<li><strong>IP-PTR-Host Mismatch Detection</strong> – automatically detect and block fake crawlers (e.g., fake Googlebots)</li>
<li><strong>Blacklist & Whitelist Management</strong> – instantly allow or block any IP, ASN, range, or User-Agent</li>
<li><strong>Live Traffic Monitoring</strong> – see all traffic in real-time: robots, humans, 404 errors, logins/logouts, file requests, and content consumption</li>
<li><strong>Server IP Identification</strong> – prevent lockouts by automatically identifying and protecting server IPs</li>
<li><strong>Visual Dashboard</strong> – intuitive charts and stats showing blocked attacks, world map of threat origins, top offending IPs/countries</li>
<li><strong>Detailed Security Log</strong> – every event logged with IP address, user agent, country, and blocking reason</li>
<li><strong>Hide Login URL</strong> <em>(Premium Addon)</em></li>
</ul>
<h4>⚡ Performance & Integration</h4>
<p>BotBlocker’s robust defense won’t slow your site down – in fact, it often improves performance under attack:</p>
<ul>
<li><strong>Lightweight & Fast</strong> – negligible overhead in normal conditions. Reduces database and server load during attacks</li>
<li><strong>Built-in Caching</strong> – Redis and Memcached support for high-traffic environments</li>
<li><strong>Cache Plugin Compatibility</strong> – automatic <code>DONOTCACHEPAGE</code> + <code>Cache-Control: no-store</code> on verification pages. Works with WP Super Cache (PHP mode), W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, and more. Server-level caches (Nginx FastCGI, Varnish, Cloudflare) may need a cookie-based bypass rule – see <code>docs/CACHE-COMPATIBILITY.md</code></li>
<li><strong>DDoS Protection Compatibility</strong> – automatic detection of JS-challenges from DDoS-Guard, Stormwall, and similar services. See <code>docs/DDOS-COMPATIBILITY.md</code> for advanced configuration</li>
<li><strong>Seamless Compatibility</strong> – works with Cloudflare, CDN services, caching plugins, and optimizers</li>
<li><strong>Full IPv6 Support</strong> – all security functions work with both IPv4 and IPv6</li>
<li><strong>Server Optimization</strong> <em>(Premium Addon)</em> – additional performance enhancements for high-traffic sites</li>
</ul>
<h4>👤 Easy Setup & User-Friendly Interface</h4>
<p>You don’t have to be a security expert to use BotBlocker:</p>
<ul>
<li><strong>Quick Installation Wizard</strong> – step-by-step setup guide for configuration in under 1 minute</li>
<li><strong>Intuitive Admin Panel</strong> – organized settings with clear descriptions and tooltips</li>
<li><strong>Multilingual</strong> – translated into English, Spanish, German, French, Polish, Russian, Ukrainian, and more</li>
<li><strong>No Conflicts</strong> – built following WordPress best practices, tested with recent WP versions</li>
<li><strong>Adjustable Logging</strong> – configurable retention periods with time zone awareness and daylight saving support</li>
</ul>
<p><strong>Security first – BotBlocker’s on guard!</strong></p>
<h4>🔥 PRO Version</h4>
<p>Upgrade to PRO for enhanced protection and performance features:</p>
<ul>
<li>Real-time cloud threat intelligence checks against global databases</li>
<li>Zero-day threat detection – behavioral analysis and heuristic rules catch unknown attack patterns before signatures are available</li>
<li>Hide login URL and protect against targeted attacks</li>
<li>Security Headers – automatic HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy (CSP) configuration</li>
<li>Early-init (Before WordPress loads) filtering for maximum performance and security</li>
<li>WordPress Acceleration – frontend optimization</li>
<li>Speed optimization features for high-traffic sites</li>
<li>Server optimization features for high-traffic sites</li>
<li>Priority support and updates</li>
<li>Access to premium add-ons</li>
</ul>
<h3>Features</h3>
<h4>Detection & Analysis</h4>
<p>BotBlocker employs advanced multi-layer detection to identify and block threats:</p>
<p><strong>Detection Mechanisms:</strong></p>
<ul>
<li>Local and cloud signature databases with real-time updates</li>
<li>IP reputation and blacklist checks with global threat intelligence</li>
<li>DNS-based and PTR lookups to detect fake crawlers</li>
<li>Heuristic and behavioral analysis for suspicious patterns</li>
<li>Browser fingerprint and feature mismatch detection</li>
<li>Header and protocol validation</li>
<li>JavaScript challenge and capability verification</li>
<li>Multi-layered CAPTCHA verification</li>
</ul>
<p><strong>Comprehensive Request Analysis:</strong></p>
<ul>
<li><strong>Network & IP:</strong> Full IPv4/IPv6 support, blacklist/whitelist, country/GeoIP, ASN, hosting/VPN detection, TOR detection, PTR/DNSBL checks</li>
<li><strong>Browser & Client:</strong> User-Agent validation, browser/OS/device detection, fingerprint analysis, headless browser detection, JavaScript/cookie support</li>
<li><strong>Headers & Protocol:</strong> Accept-Language, Referer validation, HTTP version control, Cloudflare/proxy detection</li>
<li><strong>Advanced Fingerprinting:</strong> Font rendering, WebGL, media devices, touch events, battery API, permissions, timing analysis, plugin verification</li>
</ul>
<h4>CAPTCHA Modes</h4>
<p>Choose from various CAPTCHA types to protect your site:</p>
<ul>
<li><strong>Single Button</strong> – one-click verification for quick validation</li>
<li><strong>Google reCAPTCHA v2</strong> – standard image/checkbox challenge</li>
<li><strong>Google reCAPTCHA v3</strong> – invisible background scoring</li>
<li><strong>BotBlocker Color CAPTCHA</strong> – select colored buttons challenge</li>
<li><strong>BotBlocker Digits CAPTCHA</strong> – floating math challenge</li>
<li><strong>BotBlocker Images CAPTCHA</strong> – animal image selection</li>
<li><strong>BotBlocker Shapes CAPTCHA</strong> – floating shapes challenge</li>
<li><strong>BotBlocker Hold Button</strong> – press and hold to verify, no images or math required</li>
<li><strong>Silent Auto-Verify</strong> – no CAPTCHA shown. Real users pass automatically via JS fingerprint checks; bots see “Access denied”</li>
<li><strong>Hybrid Mode</strong> – combine any CAPTCHA with reCAPTCHA v3 for dual-layer protection</li>
</ul>
<h4>Additional Capabilities</h4>
<ul>
<li>Early-init & MU plugin support</li>
<li>Real-time cloud threat checks</li>
<li>Dynamic and graphical anti-bot challenges</li>
<li>Automatic logging with adjustable retention</li>
<li>Session tracking and verification</li>
<li>No visitor data collected – GDPR/CCPA-compliant (see FAQ for admin notification details)</li>
</ul>
<h3>Privacy</h3>
<p>BotBlocker Security does <strong>not</strong> collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.</p>
<h3>Support and Documentation</h3>
<ul>
<li>Product site: <a href="https://botblocker.top/products/" rel="nofollow ugc">https://botblocker.top/products/</a></li>
<li>Documentation: <a href="https://botblocker.top/docs/" rel="nofollow ugc">https://botblocker.top/docs/</a></li>
<li>Contact/support: <a href="https://botblocker.top/contacts/" rel="nofollow ugc">https://botblocker.top/contacts/</a></li>
<li>Community: <a href="https://botblocker.top/community/" rel="nofollow ugc">https://botblocker.top/community/</a></li>
</ul>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later. See LICENSE.txt for details.</p>
<h3>Credits & Authors</h3>
<p>BotBlocker Security is developed and maintained by GLOBUS.studio.</p>
<ul>
<li>Concept, architecture & code – Yevhen Leonidov: <a href="https://leonidov.dev/" rel="nofollow ugc">https://leonidov.dev/</a></li>
<li>Code, code review – Andrii Lukashevych</li>
<li>Code, translations – Aleksandr Kinakh</li>
</ul>
<p><strong>BotBlocker Security – The first line of defense for your WordPress site.</strong></p>


BotBlocker Security – Firewall & Bot Protection

Protect your WordPress site: firewall, bot & brute-force protection, anti-spam, multi-layer CAPTCHA, optional cloud threat intel.

maheshsharmads

<p><strong>Dotsquares Custom Login URL & Security Suite</strong> helps secure your WordPress site by allowing you to change the default login URL and apply additional security layers — all from one beautifully designed dashboard.</p>
<h4>🔑 Login Security</h4>
<ul>
<li>Custom login slug — redirect wp-login.php to your own secret URL</li>
<li>Optionally hide wp-login.php (returns 404 for guests)</li>
<li>Optionally block wp-admin for non-logged-in users</li>
<li>Brute force protection with configurable lockout thresholds</li>
<li>Login honeypot trap (hidden field that catches bots)</li>
<li>Two-Factor Authentication (TOTP — works with Google Authenticator, Authy, etc.)</li>
<li>Weak username detection (blocks “admin”, “root”, “test”, etc.)</li>
<li>Force logout after inactivity (configurable timeout)</li>
<li>Manual approval for new user registrations</li>
<li>Prevent display name from matching username</li>
</ul>
<h4>🛡️ Firewall</h4>
<ul>
<li>Disable XML-RPC (common attack vector)</li>
<li>Block bad bots and fake user agents (40+ known bots)</li>
<li>Block POST requests with empty User-Agent headers</li>
<li>Rate limiting per IP address</li>
<li>IP blacklist and whitelist (supports CIDR ranges)</li>
<li>Geo-blocking by country code</li>
<li>Restrict REST API for non-logged-in users</li>
<li>Prevent user enumeration via ?author= scans</li>
</ul>
<h4>🔍 Malware & File Scanner</h4>
<ul>
<li>Deep scan of WordPress core, plugins, themes and uploads</li>
<li>40+ malware signature patterns (PHP shells, backdoors, crypto miners, pharma hacks, SEO spam injections)</li>
<li>Detects known web shells by filename (c99, r57, WSO, b374k, adminer, etc.)</li>
<li>WordPress core file integrity check (compares against official api.wordpress.org checksums)</li>
<li>Detects PHP files hidden inside the uploads folder</li>
<li>Suspicious code pattern detection (eval, exec, base64_decode combos, etc.)</li>
<li>File change detection using MD5 hash baseline</li>
<li>File permission scanner (755/644 standards)</li>
<li>.htaccess security rules generator</li>
</ul>
<h4>👥 User & Session Management</h4>
<ul>
<li>View and kill active user sessions</li>
<li>Session tracking with IP and user-agent logging</li>
<li>Manual user approval workflow</li>
</ul>
<h4>📊 Monitoring & Logs</h4>
<ul>
<li>Security event log (login, logout, failed attempts, plugin/theme changes)</li>
<li>IP blocking log with unblock controls</li>
<li>Real-time security score (A–F grade with per-check breakdown)</li>
</ul>
<h4>⚙️ Other Features</h4>
<ul>
<li>Maintenance mode with custom message</li>
<li>Database backup download</li>
<li>Email alerts for security events</li>
<li>Beautiful admin dashboard with quick-toggle switches</li>
</ul>
<h3>Important</h3>
<p>Hardening actions such as <strong>DB prefix change</strong> and <strong>wp-content rename</strong> are advanced operations.<br />
Always run these features on a <strong>staging environment</strong> and ensure you have a <strong>full backup</strong> before applying them on production.</p>


Dotsquares Custom Login URL & Security Suite

Change your WordPress login URL, design the login page, and enhance your site's security with built-in protection tools.

BotBlocker Security – Firewall & Bot Protection vs Dotsquares Custom Login URL & Security Suite