Aleksander Kinakh

Andrii Lukashevych

Yevhen Leonidov

<h4>WordPress Security Plugin & Firewall (WAF)</h4>
Every day, automated bots and hackers bombard websites with attacks. Mass botnets, fake search engine crawlers, brute-force login attempts, and spam bots can overwhelm your WordPress site – stealing data, overloading your server, and defacing content. It’s a 24/7 threat to your business. If you’re looking for WordPress site protection, you need a proactive defense that stops these attacks before they reach your website.
BotBlocker Security is the all-in-one solution to keep your site safe from automated threats. This powerful WordPress security plugin and Web Application Firewall (WAF) acts as a dedicated anti-bot firewall, blocking malicious traffic at the front gate without slowing down your site.
BotBlocker’s setup and onboarding experience allows anyone to secure their WordPress site in under 1 minute, regardless of technical expertise. You can rest assured knowing you have enabled the right site protection settings to protect your website.
<h4>🔥 WordPress Firewall (WAF)</h4>
BotBlocker Security includes an endpoint firewall/WAF that identifies and blocks malicious traffic before it reaches WordPress. Built and maintained by a team focused 100% on WordPress security, our Web Application Firewall protects your site while reducing server load.
BotBlocker intercepts bad traffic at the earliest stage – even before WordPress or your theme loads. By running as a must-use plugin (MU-plugin) on early init, it blocks threats before WordPress initializes, drastically reducing server load during attacks.
Key Firewall Features:
<ul>
<li>Real-time firewall rule updates via the BotBlocker Threat Defense Feed</li>
<li>Real-time IP Blocklist blocks all requests from the most malicious IPs</li>
<li>Early-init protection – blocks threats before WordPress loads</li>
<li>Cloud-based threat intelligence – cross-checks every visitor against global threat databases</li>
<li>No personal data collected – only technical request parameters analyzed (100% GDPR/CCPA-compliant)</li>
<li>Brute force protection with login attempt limits and multi-layer verification</li>
</ul>
<h4>📡 WordPress Security Scanner & Site Protection</h4>
Every attempt to access your site is thoroughly analyzed and filtered. BotBlocker provides comprehensive site protection across all entry points:
<ul>
<li>XML-RPC and API Protection – all endpoints blocked by default. Create access rules for trusted services and add allowed URLs for payment plugins</li>
<li>Spam Prevention – spammers cannot connect to your site. Automatically block IP addresses that exceed spam comment thresholds</li>
<li>File Access Protection – theme and plugin files securely protected from unauthorized access</li>
<li>Deep Analysis – User-Agent, Accept-Language, GeoIP, PTR, DNSBL, cookies, browser fingerprint, AdBlock, Incognito detection</li>
<li>Network & Protocol Control – block obsolete HTTP/1.0 clients and disable IPv6 if not used. Cloudflare-aware protection blocks origin bypass attempts</li>
</ul>
<h4>🔒 Login Security & Bot Protection</h4>
All login attempts pass through multi-layer filtering and CAPTCHA verification:
<ul>
<li>Multi-layer CAPTCHA Protection – color buttons, animal images, floating shapes, floating math, Google reCAPTCHA v2/v3</li>
<li>Advanced Anti-bot Challenges – proprietary CAPTCHA designed to be nearly impossible to bypass, even by AI-based anti-CAPTCHA services</li>
<li>Intelligent Ban System – failed CAPTCHA results in configurable ban periods. Repeated failures trigger 24-hour bans</li>
<li>Admin Access Simplification – special mechanism to ease site administrator login while maintaining security</li>
<li>XML-RPC Control – options including complete disabling</li>
<li>Two-Factor Authentication Support – enhanced login security for administrators</li>
</ul>
<h4>🛠️ Security Tools</h4>
Comprehensive tools to block attackers and monitor your site in real-time:
<ul>
<li>Advanced Blocking Rules – block by IP or build rules based on IP Range, Hostname, User Agent, Referrer, PTR record, ASN, country, city, and more</li>
<li>IP-PTR-Host Mismatch Detection – automatically detect and block fake crawlers (e.g., fake Googlebots)</li>
<li>Blacklist & Whitelist Management – instantly allow or block any IP, ASN, range, or User-Agent</li>
<li>Live Traffic Monitoring – see all traffic in real-time: robots, humans, 404 errors, logins/logouts, file requests, and content consumption</li>
<li>Server IP Identification – prevent lockouts by automatically identifying and protecting server IPs</li>
<li>Visual Dashboard – intuitive charts and stats showing blocked attacks, world map of threat origins, top offending IPs/countries</li>
<li>Detailed Security Log – every event logged with IP address, user agent, country, and blocking reason</li>
<li>Hide Login URL (Premium Addon)</li>
</ul>
<h4>⚡ Performance & Integration</h4>
BotBlocker’s robust defense won’t slow your site down – in fact, it often improves performance under attack:
<ul>
<li>Lightweight & Fast – negligible overhead in normal conditions. Reduces database and server load during attacks</li>
<li>Built-in Caching – Redis and Memcached support for high-traffic environments</li>
<li>Seamless Compatibility – works with Cloudflare, CDN services, caching plugins, and optimizers</li>
<li>Full IPv6 Support – all security functions work with both IPv4 and IPv6</li>
<li>Server Optimization (Premium Addon) – additional performance enhancements for high-traffic sites</li>
</ul>
<h4>👤 Easy Setup & User-Friendly Interface</h4>
You don’t have to be a security expert to use BotBlocker:
<ul>
<li>Quick Installation Wizard – step-by-step setup guide for configuration in under 1 minute</li>
<li>Intuitive Admin Panel – organized settings with clear descriptions and tooltips</li>
<li>Multilingual – translated into English, Spanish, German, French, Polish, Russian, Ukrainian, and more</li>
<li>No Conflicts – built following WordPress best practices, tested with recent WP versions</li>
<li>Adjustable Logging – configurable retention periods with time zone awareness and daylight saving support</li>
</ul>
Security first – BotBlocker’s on guard!
<h3>Features</h3>
<h4>Detection & Analysis</h4>
BotBlocker employs advanced multi-layer detection to identify and block threats:
Detection Mechanisms:
<ul>
<li>Local and cloud signature databases with real-time updates</li>
<li>IP reputation and blacklist checks with global threat intelligence</li>
<li>DNS-based and PTR lookups to detect fake crawlers</li>
<li>Heuristic and behavioral analysis for suspicious patterns</li>
<li>Browser fingerprint and feature mismatch detection</li>
<li>Header and protocol validation</li>
<li>JavaScript challenge and capability verification</li>
<li>Multi-layered CAPTCHA verification</li>
</ul>
Comprehensive Request Analysis:
<ul>
<li>Network & IP: Full IPv4/IPv6 support, blacklist/whitelist, country/GeoIP, ASN, hosting/VPN detection, TOR detection, PTR/DNSBL checks</li>
<li>Browser & Client: User-Agent validation, browser/OS/device detection, fingerprint analysis, headless browser detection, JavaScript/cookie support</li>
<li>Headers & Protocol: Accept-Language, Referer validation, HTTP version control, Cloudflare/proxy detection</li>
<li>Advanced Fingerprinting: Font rendering, WebGL, media devices, touch events, battery API, permissions, timing analysis, plugin verification</li>
</ul>
<h4>CAPTCHA Modes</h4>
Choose from various CAPTCHA types to protect your site:
<ul>
<li>Single Button – one-click verification for quick validation</li>
<li>Google reCAPTCHA v2 – standard image/checkbox challenge</li>
<li>Google reCAPTCHA v3 – invisible background scoring</li>
<li>BotBlocker Color CAPTCHA – select colored buttons challenge</li>
<li>BotBlocker Digits CAPTCHA – floating math challenge</li>
<li>BotBlocker Images CAPTCHA – animal image selection</li>
<li>BotBlocker Shapes CAPTCHA – floating shapes challenge</li>
<li>Hybrid Mode – combine any CAPTCHA with reCAPTCHA v3 for dual-layer protection</li>
</ul>
<h4>Additional Capabilities</h4>
<ul>
<li>Early-init & MU plugin support</li>
<li>Real-time cloud threat checks</li>
<li>Dynamic and graphical anti-bot challenges</li>
<li>Automatic logging with adjustable retention</li>
<li>Session tracking and verification</li>
<li>No personal data collected (100% GDPR/CCPA-compliant)</li>
</ul>
<h3>Privacy</h3>
BotBlocker Security does not collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.
<h3>Support and Documentation</h3>
<ul>
<li>Product site: <a href="https://botblocker.top/products/" rel="nofollow ugc">https://botblocker.top/products/</a></li>
<li>Documentation: <a href="https://botblocker.top/docs/" rel="nofollow ugc">https://botblocker.top/docs/</a></li>
<li>Contact/support: <a href="https://botblocker.top/contacts/" rel="nofollow ugc">https://botblocker.top/contacts/</a></li>
<li>Community: <a href="https://botblocker.top/community/" rel="nofollow ugc">https://botblocker.top/community/</a></li>
</ul>
<h3>License</h3>
This plugin is licensed under the GPLv2 or later. See LICENSE.txt for details.
<h3>Credits & Authors</h3>
BotBlocker Security is developed and maintained by GLOBUS.studio.
<ul>
<li>Concept, architecture & code – Yevhen Leonidov: <a href="https://leonidov.dev/" rel="nofollow ugc">https://leonidov.dev/</a></li>
<li>Code, code review – Andrii Lukashevych</li>
<li>Code, translations – Aleksandr Kinakh</li>
</ul>
BotBlocker Security – The first line of defense for your WordPress site.

BotBlocker Security – Firewall & Bot Protection

Protect your WordPress site: firewall, bot & brute-force protection, anti-spam, multi-layer CAPTCHA, optional cloud threat intel.

jp-secure

You can find docs, FAQ and more detailed information on <a href="https://www.jp-secure.com/siteguard_wp_plugin_en/" rel="nofollow ugc">English Page</a> <a href="https://www.jp-secure.com/siteguard_wp_plugin/" rel="nofollow ugc">Japanese Page</a>.
Simply install the SiteGuard WP Plugin, WordPress security is improved. 
This plugin is a security plugin that specializes in the login attack of brute force, such as protection and management capabilities.
Notes
<ul>
<li>It does not support the multisite function of WordPress.</li>
<li>It only supports Apache 1.3, 2.x for Web servers.</li>
<li>To use the CAPTCHA function, the expansion library “mbstring” and “gd” should be installed on php.</li>
<li>To use the management page filter function and login page change function, “mod_rewrite” should be loaded on Apache.</li>
<li>To use the WAF Tuning Support, WAF ( SiteGuard Server Edition ) should be installed on Apache.</li>
</ul>
There are the following functions.
<ul>
<li>Admin Page IP Filter</li>
</ul>
It is the function for the protection against the attack to the management page (under wp-admin.) 
To the access from the connection source IP address which does not login to the management page, 404 (Not Found) is returned. 
At the login, the connection source IP address is recorded and the access to that page is allowed. 
The connection source IP address which does not login for more than 24 hours is sequentially deleted. 
The URL (under wp-admin) where this function is excluded can be specified.
<ul>
<li>Rename Login</li>
</ul>
It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack. 
The login page name (wp-login.php) is changed. The initial value is “login_<5 random digits>” but it can be changed to a favorite name.
<ul>
<li>CAPTCHA</li>
</ul>
It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack, 
or to receive less comment spam. For the character of CAPTCHA, hiragana and alphanumeric characters can be selected.
<ul>
<li>Login Lock</li>
</ul>
It is the function to decrease the vulnerability against an illegal login attempt attack such as a brute force attack or a password list attack. 
Especially, it is the function to prevent an automated attack. The connection source IP address the number of login failure of which reaches 
the specified number within the specified period is blocked for the specified time. 
Each user account is not locked.
<ul>
<li>Login Alert</li>
</ul>
It is the function to make it easier to notice unauthorized login. E-mail will be sent to a login user when logged in. 
If you receive an e-mail to there is no logged-in idea, please suspect unauthorized login.
<ul>
<li>Fail Once</li>
</ul>
It is the function to decrease the vulnerability against a password list attack. Even is the login input is correct, the first login must fail. 
After 5 seconds and later within 60 seconds, another correct login input make login succeed. At the first login failure, the following error message is displayed.
<ul>
<li>Disable Pingback</li>
</ul>
The pingback function is disabled and its abuse is prevented.
<ul>
<li>Block Author Query</li>
</ul>
Prevents leakage of user names due to “/?author=” access.
<ul>
<li>Updates Notify</li>
</ul>
Basic of security is that always you use the latest version. If WordPress core, plugins, and themes updates are needed , sends email to notify administrators.
<ul>
<li>WAF Tuning Support</li>
</ul>
It is the function to create the rule to avoid the false detection in WordPress (including 403 error occurrence with normal access,) 
if WAF ( SiteGuard Server Edition ) by EG Secure Solutions is installed on a Web server. WAF prevents the attack from the outside against the Web server, 
but for some WordPress or plugin functions, WAF may detect the attack which is actually not attack and block the function. 
By creating the WAF exclude rule, the WAF protection function can be activated while the false detection for the specified function is prevented.
<h4>Translate</h4>
If you have created your own language pack, or have an update of an existing one, you can send <a href="https://codex.wordpress.org/Translating_WordPress" rel="nofollow ugc">gettext PO and MO files</a> to sgdev@jp-secure.com so that We can bundle it into SiteGuard WP Plugin. You can download the latest <a href="https://plugins.svn.wordpress.org/siteguard/trunk/languages/siteguard.pot" rel="nofollow ugc">POT file</a>, and <a href="https://plugins.svn.wordpress.org/siteguard/branches/languages/" rel="nofollow ugc">PO files in each language</a>.

SiteGuard WP Plugin


誰でもユーザーを登録できるサイトを作っているのですが、ログイン保護機能を利用しています。スパムアカウントが減りました。


ログイン保護に利用しています

SiteGurad WP Plugin is the plugin specialized for the protection against the attack to the management page and login.

BotBlocker Security – Firewall & Bot Protection vs SiteGuard WP Plugin