Yevhen Leonidov

Aleksander Kinakh

Andrii Lukashevych

<p><strong>BotBlocker Security blocks 99% of automated attacks before WordPress even loads.</strong> No bloat, no slowdowns, no monthly fees for core protection.</p>
<p>If your site is hit by login brute force, spam comments, fake Googlebots, content scrapers, or XML-RPC floods, you are not alone: bots generate over 47% of all web traffic. Most security plugins react after WordPress boots, wasting CPU and memory on every bad request. <strong>BotBlocker stops them at the door.</strong></p>
<h4>Why site owners switch to BotBlocker</h4>
<ul>
<li><strong>Faster than the competition.</strong> Runs on early init through three interception layers, before themes and plugins load. Server load drops during attacks instead of spiking.</li>
<li><strong>Smarter CAPTCHA.</strong> 9 modes including Silent Auto-Verify – zero clicks for humans, hard wall for bots. Proprietary CAPTCHAs defeat AI-based solvers that crack reCAPTCHA for $2-3 per 1 000.</li>
<li><strong>Honest free version.</strong> Full firewall, all 9 CAPTCHA modes, full 2FA, full logging, full Multisite support. No nag screens, no crippled features.</li>
<li><strong>Privacy-first.</strong> No visitor data leaves your server. GDPR and CCPA compliant out of the box.</li>
<li><strong>Works with everything.</strong> Cloudflare, WP Rocket, LiteSpeed, WooCommerce, Elementor, multisite, IPv6, PHP 7.4 to 8.5.</li>
</ul>
<h4>🛡️ Core Firewall (Free)</h4>
<ul>
<li><strong>Three-Layer Architecture</strong> – intercepts traffic at wp-config.php (before WordPress), MU-plugin phase, and main shield. The first layer blocks known threats without loading WordPress at all, saving 30-100ms and 5-20MB RAM per blocked request.</li>
<li><strong>Web Application Firewall (WAF)</strong> with real-time rule updates via the BotBlocker Threat Defense Feed</li>
<li><strong>2 899 User-Agent signatures</strong> – largest blacklist among WordPress plugins – covering Scrapy, Selenium, Puppeteer, PhantomJS, curl, wget, Python, Java, Perl, and SQL injection tools</li>
<li><strong>Brute force protection</strong> with progressive lockouts – 5 attempts per 15 minutes, escalating bans for repeat offenders</li>
<li><strong>Anti-spam</strong> for comments, registration, contact forms – spammers blocked before they connect</li>
<li><strong>XML-RPC and REST API</strong> locked down by default with allowlist for trusted services</li>
<li><strong>Fake crawler detection</strong> via FCrDNS (dual-direction DNS verification), ASN tokens, and published IP ranges – 95% effective, impossible to spoof without controlling the provider’s DNS zone</li>
<li><strong>LLM / AI crawler management</strong> – allow or block GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Bytespider via CIDR-verified IP ranges. Trusted crawlers verified, impersonators blocked.</li>
<li><strong>Country, ASN, IP range, User-Agent, Referer</strong> blocking rules with instant enforcement</li>
<li><strong>Cloudflare-aware</strong> real-IP resolution and origin bypass protection</li>
<li><strong>Full IPv6 support</strong> – separate tables and logic for IPv4 and IPv6, every feature works with both</li>
<li><strong>Live traffic monitor</strong> with attack map, country, ASN, device, browser, and exact block reason for every request</li>
<li><strong>Built-in caching</strong> via Redis and Memcached – free, auto-disable on connection failure</li>
</ul>
<h4>🔒 Login Security & 2FA (Free)</h4>
<ul>
<li><strong>Two-Factor Authentication</strong> compatible with Google Authenticator, Authy, 1Password, Bitwarden – TOTP standard with 10 backup codes</li>
<li><strong>9 CAPTCHA modes</strong>: Silent Auto-Verify, Single Button, Color CAPTCHA, Images CAPTCHA, Shapes CAPTCHA (60fps Canvas), Digits CAPTCHA, Hold Button CAPTCHA, plus Google reCAPTCHA v2 and v3</li>
<li><strong>Hybrid Mode</strong> – combine any internal CAPTCHA with reCAPTCHA v3 for two-layer invisible defense</li>
<li><strong>Hide login URL</strong> <em>(PRO)</em></li>
<li><strong>Configurable lockout durations</strong> with escalation for repeat offenders – failed CAPTCHA triggers short ban, repeated failure triggers 24-hour ban</li>
</ul>
<h4>💳 Payment Gateway Bypass (Free)</h4>
<p>Auto-detects 25+ e-commerce platforms (WooCommerce, Easy Digital Downloads, SureCart, MemberPress, Paid Memberships Pro, Give, Dokan, CartFlows, FunnelKit, and more) and 150+ payment providers (Stripe, PayPal, Mollie, Adyen, Braintree, Square, Razorpay, Klarna, Paddle, Authorize.Net, 2Checkout, YooKassa, LiqPay, and more). <strong>Webhooks, IPN callbacks, and payment notifications never get blocked.</strong> Four detection layers ensure zero false positives on payment traffic.</p>
<h4>📊 Visibility & Control (Free)</h4>
<ul>
<li>Visual dashboard with attack map, top offenders, blocked-vs-allowed ratio, world traffic map</li>
<li>Detailed event log with IP, country, ASN, User-Agent, and exact block reason – 54 unique event codes</li>
<li>Health Score gauge – 42 parameters across 3 categories, 5 security levels from Critical to Secure</li>
<li>3 security presets – Light, Strong, Full – one-click configuration</li>
<li>Setup Wizard – 8 steps from welcome to test attack, setup in under 5 minutes</li>
<li>8 interface languages – English, Deutsch, Español, Français, Polski, Русский, Українська + POT template</li>
<li>Configurable retention with timezone and DST awareness</li>
<li>Clean uninstall – drops all 16 tables, removes 40+ options, clears cron hooks. Zero leftover data.</li>
</ul>
<h4>🚀 PRO Adds (Premium / Pro / Ultimate)</h4>
<ul>
<li>Real-time cloud threat intelligence cross-checked against global databases – 5M+ attack IPs, hundreds of thousands of bot signatures, updated daily</li>
<li>Zero-day behavioral and heuristic detection – catches unknown attack patterns before signatures exist</li>
<li>VPN, Tor, proxy, ASN, and hosting reputation checks</li>
<li>Early Init Mode – filtering before WordPress Core loads, maximum resource savings during attacks</li>
<li>Hide Login URL addon – custom admin URL, hardened wp-login.php protection</li>
<li>Security Headers addon – HSTS, CSP, X-Frame-Options, Permissions-Policy, Referrer-Policy, X-Content-Type-Options</li>
<li>Speed Up WordPress addon – 14 frontend and server optimizations</li>
<li>Malware Scanner addon – 25 patterns scanning files + 7 database tables, detects webshells, eval injections, base64-obfuscated code hidden in wp_options and post_content</li>
<li>Priority support – 24-hour response time</li>
</ul>
<p>Four plans to match your traffic: <strong>Premium</strong> ($12/month, 25k cloud checks), <strong>Pro</strong> ($50/month, 100k cloud checks), <strong>Ultimate</strong> ($100/month, 250k cloud checks + emergency 24h support). Annual billing includes 1 month free. 30-day refund policy. Licensed per domain, billed securely via Freemius.</p>
<p><a href="https://botblocker.top/pricing/" rel="nofollow ugc">Compare plans <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></p>
<h4>⚡ Performance & Compatibility</h4>
<ul>
<li><strong>Zero database queries</strong> for returning visitors – 9 runtime PHP files with SHA-256 integrity signatures, loaded via <code>include</code></li>
<li>Measured overhead: <strong>+3-15ms</strong> TTFB for cached visitors, <strong>+50-200ms</strong> for first-time PTR lookups, <strong>+2-4MB</strong> memory</li>
<li>Redis and Memcached support – free, auto-disables gracefully on connection failure</li>
<li><strong>Cache plugin compatibility</strong> – automatic <code>DONOTCACHEPAGE</code> and <code>Cache-Control: no-store</code> on verification pages. Works with WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, WP Fastest Cache, Cache Enabler</li>
<li><strong>CDN and WAF compatibility</strong> – Cloudflare, Sucuri, Incapsula, AWS CloudFront, Fastly, KeyCDN, StackPath. Multi-header real-IP resolution (CF-Connecting-IP, X-Forwarded-For, X-Real-IP)</li>
<li><strong>DDoS Protection Compatibility</strong> – automatic detection of JS-challenges from DDoS-Guard, Stormwall, Qrator. HMAC-signed AJAX responses, Circuit Breaker with automatic retry and backoff. BotBlocker is the only WordPress plugin that works correctly behind aggressive DDoS protection without manual configuration.</li>
<li><strong>Multisite Support</strong> – network activation, per-site data, per-site cleanup. Free on all plans.</li>
<li><strong>PHP 7.4 – 8.5</strong> – tested across 7 PHP versions. <strong>WordPress 5.0 – 7.0+</strong>. Linux and Windows.</li>
<li>GDPR and CCPA compliant – no PII collected, technical parameters only, Legitimate Interest basis (Art. 6(1)(f))</li>
</ul>
<h4>🤝 Trusted by</h4>
<ul>
<li>3 000+ active installations</li>
<li>Translated into 8 languages</li>
<li>Tested up to WordPress 7.0 and PHP 8.5</li>
<li>Developed and maintained by GLOBUS.studio</li>
</ul>
<blockquote>
<p>“Replaced two security plugins and a CAPTCHA plugin with one. Site is faster and the spam stopped overnight.” – WordPress.org user</p>
</blockquote>
<h3>Privacy</h3>
<p>BotBlocker Security does <strong>not</strong> collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.</p>
<h3>Support and Documentation</h3>
<ul>
<li>Product site: <a href="https://botblocker.top/products/" rel="nofollow ugc">https://botblocker.top/products/</a></li>
<li>Pricing and PRO plans: <a href="https://botblocker.top/pricing/" rel="nofollow ugc">https://botblocker.top/pricing/</a></li>
<li>Documentation: <a href="https://botblocker.top/docs/" rel="nofollow ugc">https://botblocker.top/docs/</a></li>
<li>Contact/support: <a href="https://botblocker.top/contacts/" rel="nofollow ugc">https://botblocker.top/contacts/</a></li>
<li>Community: <a href="https://botblocker.top/community/" rel="nofollow ugc">https://botblocker.top/community/</a></li>
</ul>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later. See LICENSE.txt for details.</p>
<h3>Credits & Authors</h3>
<p>BotBlocker Security is developed and maintained by GLOBUS.studio.</p>
<ul>
<li>Concept, architecture & code – Yevhen Leonidov: <a href="https://leonidov.dev/" rel="nofollow ugc">https://leonidov.dev/</a></li>
<li>Code, code review – Andrii Lukashevych</li>
<li>Code, translations – Aleksandr Kinakh</li>
</ul>
<p><strong>BotBlocker Security – The first line of defense for your WordPress site.</strong></p>


BotBlocker Security – Firewall & Bot Protection

Stop bots, brute force, spam, and fake crawlers before they reach WordPress. Three-layer firewall, 9 CAPTCHAs, FCrDNS, 2FA. Setup in 60 seconds.

BotBlocker Security – Firewall & Bot Protection vs IP Geo Block