Yevhen Leonidov

Aleksander Kinakh

Andrii Lukashevych

<h4>WordPress Security Plugin & Firewall (WAF)</h4>
<p><strong>Every day, automated bots and hackers bombard websites with attacks.</strong> Mass botnets, fake search engine crawlers, brute-force login attempts, and spam bots can overwhelm your WordPress site – stealing data, overloading your server, and defacing content. It’s a 24/7 threat to your business. If you’re looking for <strong>WordPress site protection</strong>, you need a proactive defense that stops these attacks before they reach your website.</p>
<p><strong>BotBlocker Security is the all-in-one solution to keep your site safe from automated threats.</strong> This powerful <strong>WordPress security plugin and Web Application Firewall (WAF)</strong> acts as a dedicated <strong>anti-bot</strong> firewall, blocking malicious traffic at the front gate without slowing down your site.</p>
<p>BotBlocker’s setup and onboarding experience allows anyone to secure their <strong>WordPress site</strong> in under 1 minute, regardless of technical expertise. You can rest assured knowing you have enabled the right <strong>site protection</strong> settings to protect your website.</p>
<h4>🔥 WordPress Firewall (WAF)</h4>
<p>BotBlocker Security includes an endpoint <strong>firewall/WAF</strong> that identifies and blocks malicious traffic before it reaches WordPress. Built and maintained by a team focused 100% on WordPress security, our Web Application Firewall protects your site while reducing server load.</p>
<p><strong>BotBlocker intercepts bad traffic at the earliest stage</strong> – even before WordPress or your theme loads. By running as a must-use plugin (MU-plugin) on early init, it blocks threats before WordPress initializes, drastically reducing server load during attacks.</p>
<p><strong>Key Firewall Features:</strong></p>
<ul>
<li>Real-time firewall rule updates via the BotBlocker Threat Defense Feed</li>
<li>Real-time IP Blocklist blocks all requests from the most malicious IPs</li>
<li>Early-init protection – blocks threats before WordPress loads</li>
<li>Cloud-based threat intelligence – cross-checks every visitor against global threat databases</li>
<li>No visitor data collected – only technical request parameters analyzed (GDPR/CCPA-compliant)</li>
<li>Brute force protection with login attempt limits and multi-layer verification</li>
</ul>
<h4>📡 WordPress Security Scanner & Site Protection</h4>
<p>Every attempt to access your site is thoroughly analyzed and filtered. BotBlocker provides comprehensive <strong>site protection</strong> across all entry points:</p>
<ul>
<li><strong>XML-RPC and API Protection</strong> – all endpoints blocked by default. Create access rules for trusted services and add allowed URLs for payment plugins</li>
<li><strong>Spam Prevention</strong> – spammers cannot connect to your site. Automatically block IP addresses that exceed spam comment thresholds</li>
<li><strong>File Access Protection</strong> – theme and plugin files securely protected from unauthorized access</li>
<li><strong>Deep Analysis</strong> – User-Agent, Accept-Language, GeoIP, PTR, DNSBL, cookies, browser fingerprint, AdBlock, Incognito detection</li>
<li><strong>Network & Protocol Control</strong> – block obsolete HTTP/1.0 clients and disable IPv6 if not used. Cloudflare-aware protection blocks origin bypass attempts</li>
</ul>
<h4>🔒 Login Security & 2FA</h4>
<p>All login attempts pass through multi-layer filtering and CAPTCHA verification:</p>
<ul>
<li><strong>Two-Factor Authentication Support</strong> – 2FA enhanced login security for admin area. Backup codes for recovery access. Universal 2FA app support – works with Google Authenticator, Authy, etc.</li>
<li><strong>Multi-layer CAPTCHA Protection</strong> – color buttons, animal images, floating shapes, floating math, Google reCAPTCHA v2/v3, and more. Any internal CAPTCHA can be combined with reCAPTCHA v3 for dual-layer protection</li>
<li><strong>Brute Force Protection</strong> – configurable login attempt limits. Failed attempts trigger temporary bans, with escalating penalties for repeated failures</li>
<li><strong>Advanced Anti-bot Challenges</strong> – proprietary CAPTCHA designed to be nearly impossible to bypass, even by AI-based anti-CAPTCHA services</li>
<li><strong>Intelligent Ban System</strong> – failed CAPTCHA results in configurable ban periods. Repeated failures trigger 24-hour bans</li>
<li><strong>Admin Access Simplification</strong> – special mechanism to ease site administrator login while maintaining security</li>
<li><strong>XML-RPC Control</strong> – options including complete disabling</li>
</ul>
<h4>🛠️ Security Tools</h4>
<p>Comprehensive tools to block attackers and monitor your site in real-time:</p>
<ul>
<li><strong>Advanced Blocking Rules</strong> – block by IP or build rules based on IP Range, Hostname, User Agent, Referrer, PTR record, ASN, country, city, and more</li>
<li><strong>IP-PTR-Host Mismatch Detection</strong> – automatically detect and block fake crawlers (e.g., fake Googlebots)</li>
<li><strong>Blacklist & Whitelist Management</strong> – instantly allow or block any IP, ASN, range, or User-Agent</li>
<li><strong>Live Traffic Monitoring</strong> – see all traffic in real-time: robots, humans, 404 errors, logins/logouts, file requests, and content consumption</li>
<li><strong>Server IP Identification</strong> – prevent lockouts by automatically identifying and protecting server IPs</li>
<li><strong>Visual Dashboard</strong> – intuitive charts and stats showing blocked attacks, world map of threat origins, top offending IPs/countries</li>
<li><strong>Detailed Security Log</strong> – every event logged with IP address, user agent, country, and blocking reason</li>
<li><strong>Hide Login URL</strong> <em>(Premium Addon)</em></li>
</ul>
<h4>⚡ Performance & Integration</h4>
<p>BotBlocker’s robust defense won’t slow your site down – in fact, it often improves performance under attack:</p>
<ul>
<li><strong>Lightweight & Fast</strong> – negligible overhead in normal conditions. Reduces database and server load during attacks</li>
<li><strong>Built-in Caching</strong> – Redis and Memcached support for high-traffic environments</li>
<li><strong>Cache Plugin Compatibility</strong> – automatic <code>DONOTCACHEPAGE</code> + <code>Cache-Control: no-store</code> on verification pages. Works with WP Super Cache (PHP mode), W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, and more. Server-level caches (Nginx FastCGI, Varnish, Cloudflare) may need a cookie-based bypass rule – see <code>docs/CACHE-COMPATIBILITY.md</code></li>
<li><strong>DDoS Protection Compatibility</strong> – automatic detection of JS-challenges from DDoS-Guard, Stormwall, and similar services. See <code>docs/DDOS-COMPATIBILITY.md</code> for advanced configuration</li>
<li><strong>Seamless Compatibility</strong> – works with Cloudflare, CDN services, caching plugins, and optimizers</li>
<li><strong>Full IPv6 Support</strong> – all security functions work with both IPv4 and IPv6</li>
<li><strong>Server Optimization</strong> <em>(Premium Addon)</em> – additional performance enhancements for high-traffic sites</li>
</ul>
<h4>👤 Easy Setup & User-Friendly Interface</h4>
<p>You don’t have to be a security expert to use BotBlocker:</p>
<ul>
<li><strong>Quick Installation Wizard</strong> – step-by-step setup guide for configuration in under 1 minute</li>
<li><strong>Intuitive Admin Panel</strong> – organized settings with clear descriptions and tooltips</li>
<li><strong>Multilingual</strong> – translated into English, Spanish, German, French, Polish, Russian, Ukrainian, and more</li>
<li><strong>No Conflicts</strong> – built following WordPress best practices, tested with recent WP versions</li>
<li><strong>Adjustable Logging</strong> – configurable retention periods with time zone awareness and daylight saving support</li>
</ul>
<p><strong>Security first – BotBlocker’s on guard!</strong></p>
<h4>🔥 PRO Version</h4>
<p>Upgrade to PRO for enhanced protection and performance features:</p>
<ul>
<li>Real-time cloud threat intelligence checks against global databases</li>
<li>Zero-day threat detection – behavioral analysis and heuristic rules catch unknown attack patterns before signatures are available</li>
<li>Hide login URL and protect against targeted attacks</li>
<li>Security Headers – automatic HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy (CSP) configuration</li>
<li>Early-init (Before WordPress loads) filtering for maximum performance and security</li>
<li>WordPress Acceleration – frontend optimization</li>
<li>Speed optimization features for high-traffic sites</li>
<li>Server optimization features for high-traffic sites</li>
<li>Priority support and updates</li>
<li>Access to premium add-ons</li>
</ul>
<h3>Features</h3>
<h4>Detection & Analysis</h4>
<p>BotBlocker employs advanced multi-layer detection to identify and block threats:</p>
<p><strong>Detection Mechanisms:</strong></p>
<ul>
<li>Local and cloud signature databases with real-time updates</li>
<li>IP reputation and blacklist checks with global threat intelligence</li>
<li>DNS-based and PTR lookups to detect fake crawlers</li>
<li>Heuristic and behavioral analysis for suspicious patterns</li>
<li>Browser fingerprint and feature mismatch detection</li>
<li>Header and protocol validation</li>
<li>JavaScript challenge and capability verification</li>
<li>Multi-layered CAPTCHA verification</li>
</ul>
<p><strong>Comprehensive Request Analysis:</strong></p>
<ul>
<li><strong>Network & IP:</strong> Full IPv4/IPv6 support, blacklist/whitelist, country/GeoIP, ASN, hosting/VPN detection, TOR detection, PTR/DNSBL checks</li>
<li><strong>Browser & Client:</strong> User-Agent validation, browser/OS/device detection, fingerprint analysis, headless browser detection, JavaScript/cookie support</li>
<li><strong>Headers & Protocol:</strong> Accept-Language, Referer validation, HTTP version control, Cloudflare/proxy detection</li>
<li><strong>Advanced Fingerprinting:</strong> Font rendering, WebGL, media devices, touch events, battery API, permissions, timing analysis, plugin verification</li>
</ul>
<h4>CAPTCHA Modes</h4>
<p>Choose from various CAPTCHA types to protect your site:</p>
<ul>
<li><strong>Single Button</strong> – one-click verification for quick validation</li>
<li><strong>Google reCAPTCHA v2</strong> – standard image/checkbox challenge</li>
<li><strong>Google reCAPTCHA v3</strong> – invisible background scoring</li>
<li><strong>BotBlocker Color CAPTCHA</strong> – select colored buttons challenge</li>
<li><strong>BotBlocker Digits CAPTCHA</strong> – floating math challenge</li>
<li><strong>BotBlocker Images CAPTCHA</strong> – animal image selection</li>
<li><strong>BotBlocker Shapes CAPTCHA</strong> – floating shapes challenge</li>
<li><strong>BotBlocker Hold Button</strong> – press and hold to verify, no images or math required</li>
<li><strong>Silent Auto-Verify</strong> – no CAPTCHA shown. Real users pass automatically via JS fingerprint checks; bots see “Access denied”</li>
<li><strong>Hybrid Mode</strong> – combine any CAPTCHA with reCAPTCHA v3 for dual-layer protection</li>
</ul>
<h4>Additional Capabilities</h4>
<ul>
<li>Early-init & MU plugin support</li>
<li>Real-time cloud threat checks</li>
<li>Dynamic and graphical anti-bot challenges</li>
<li>Automatic logging with adjustable retention</li>
<li>Session tracking and verification</li>
<li>No visitor data collected – GDPR/CCPA-compliant (see FAQ for admin notification details)</li>
</ul>
<h3>Privacy</h3>
<p>BotBlocker Security does <strong>not</strong> collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.</p>
<h3>Support and Documentation</h3>
<ul>
<li>Product site: <a href="https://botblocker.top/products/" rel="nofollow ugc">https://botblocker.top/products/</a></li>
<li>Documentation: <a href="https://botblocker.top/docs/" rel="nofollow ugc">https://botblocker.top/docs/</a></li>
<li>Contact/support: <a href="https://botblocker.top/contacts/" rel="nofollow ugc">https://botblocker.top/contacts/</a></li>
<li>Community: <a href="https://botblocker.top/community/" rel="nofollow ugc">https://botblocker.top/community/</a></li>
</ul>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later. See LICENSE.txt for details.</p>
<h3>Credits & Authors</h3>
<p>BotBlocker Security is developed and maintained by GLOBUS.studio.</p>
<ul>
<li>Concept, architecture & code – Yevhen Leonidov: <a href="https://leonidov.dev/" rel="nofollow ugc">https://leonidov.dev/</a></li>
<li>Code, code review – Andrii Lukashevych</li>
<li>Code, translations – Aleksandr Kinakh</li>
</ul>
<p><strong>BotBlocker Security – The first line of defense for your WordPress site.</strong></p>


BotBlocker Security – Firewall & Bot Protection

Protect your WordPress site: firewall, bot & brute-force protection, anti-spam, multi-layer CAPTCHA, optional cloud threat intel.

SRWorks LLC

<p><strong>ArmorLite</strong> is a free, lightweight WordPress security plugin built for performance. Firewall with 600+ built-in patterns, brute force protection, bot detection, security headers, and login monitoring. No bloat, no unnecessary database queries, no external API calls during normal operation.</p>
<h4>Free Features</h4>
<ul>
<li><strong>Firewall</strong> — Pure PHP string-matching firewall with 600+ built-in patterns covering SQL injection, XSS, path traversal, shell access, and more. Five categories (Request URI, Query String, User Agent, Referrer, IP Address). Three matching modes: contains, ends-with, and path-only. Pattern manager with per-pattern toggle and hit counts.</li>
<li><strong>Brute Force Protection</strong> — Session-based login tracking with automatic IP lockouts after configurable failed attempts. Login activity log with IP, location, status badges, and usernames tried. 7-day log retention.</li>
<li><strong>Bot Protection</strong> — Automated bot detection for login, registration, and password reset forms using honeypot fields, timestamp validation, and JavaScript token verification. Blocks bots before they can attempt brute force attacks.</li>
<li><strong>Security Headers</strong> — Four managed headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection) with dual delivery via PHP and .htaccess. Header probe system avoids duplicates.</li>
<li><strong>IP Whitelist</strong> — Whitelist trusted IPs to bypass all security checks including brute force lockouts and firewall blocking.</li>
<li><strong>Obfuscation</strong> — Author slug randomization to prevent user enumeration and email obfuscation to protect addresses from scrapers.</li>
<li><strong>Dashboard</strong> — Real-time stats, blocks over time chart, protection status cards, and WordPress dashboard widget.</li>
<li><strong>XML-RPC & REST API Protection</strong> — Disable XML-RPC and protect the REST API from user enumeration.</li>
<li><strong>Firewall Log</strong> — View blocked requests with IP, matched rule, request URI, and timestamps. 7-day log retention.</li>
<li><strong>Tools</strong> — Health checks with database integrity verification, one-click table repair, and debug mode.</li>
</ul>
<h4>Upgrade to ArmorPro</h4>
<p>Need more protection? <a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">ArmorPro</a> adds:</p>
<ul>
<li>WAF Engine (blocks attacks before WordPress loads)</li>
<li>Two-Factor Authentication (TOTP) with backup codes</li>
<li>Passkey Authentication (Face ID, Touch ID, Windows Hello)</li>
<li>Custom Login URL (hide wp-login.php)</li>
<li>IP Blacklist with auto-blacklist for repeat offenders</li>
<li>Country Blocking with GeoIP</li>
<li>HSTS, Content-Security-Policy, and Permissions-Policy headers</li>
<li>Email Notifications and digest summaries</li>
<li>Extended log retention (90 days)</li>
<li>Custom firewall patterns</li>
<li>Export/import settings</li>
</ul>
<p><a href="https://srworks.co/plugins/armorpro/?utm_source=armorlite&utm_medium=readme&utm_campaign=description#pricing" rel="nofollow ugc">Learn more about ArmorPro</a></p>
<h3>External Services</h3>
<p>This plugin connects to external third-party services in the following situations:</p>
<h4>Anonymous Usage Data (Optional)</h4>
<p>This plugin can optionally share anonymous usage data to help improve ArmorLite. This is disabled by default and requires explicit opt-in from the Settings page.</p>
<ul>
<li>When it is called: Daily heartbeat (if opted in)</li>
<li>Data sent: WordPress version, PHP version, active plugin features (no personal data)</li>
<li>Service: https://api.srworks.co</li>
<li>Privacy: https://srworks.co/privacy</li>
</ul>
<p>No personal data is collected or stored by this service.</p>
<h3>Privacy Policy</h3>
<p>ArmorLite stores the following data locally in your WordPress database:</p>
<ul>
<li>IP addresses of visitors who trigger security rules or attempt to log in</li>
<li>Timestamps of security events</li>
<li>Usernames used in login attempts</li>
</ul>
<p>This data is stored to help you monitor and protect your website. You can clear all logs at any time from the Tools tab. When the plugin is uninstalled, all data is automatically deleted.</p>
<p>No visitor data is sent to external services during normal operation. Anonymous usage data sharing is optional and disabled by default.</p>
<h3>Support</h3>
<p>Need help with ArmorLite? Have a feature request or found a bug?</p>
<p>Visit our support page: https://srworks.co/contact</p>
<h3>Credits</h3>
<p>Firewall patterns inspired by the work of Jeff Starr at Perishable Press (https://perishablepress.com). Used under GPLv2.</p>
<p>Charts powered by Chart.js (https://www.chartjs.org), MIT License.</p>
<p>Tooltips powered by Tippy.js (https://atomiks.github.io/tippyjs), MIT License.</p>


SRWorks ArmorPro Lite

Free WordPress security with firewall, brute force protection, bot detection, security headers, IP whitelist, and login monitoring. No bloat.

BotBlocker Security – Firewall & Bot Protection vs SRWorks ArmorPro Lite