Yevhen Leonidov

Aleksander Kinakh

Andrii Lukashevych

<p><strong>BotBlocker Security blocks 99% of automated attacks before WordPress even loads.</strong> No bloat, no slowdowns, no monthly fees for core protection.</p>
<p>If your site is hit by login brute force, spam comments, fake Googlebots, content scrapers, or XML-RPC floods, you are not alone: bots generate over 47% of all web traffic. Most security plugins react after WordPress boots, wasting CPU and memory on every bad request. <strong>BotBlocker stops them at the door.</strong></p>
<h4>Why site owners switch to BotBlocker</h4>
<ul>
<li><strong>Faster than the competition.</strong> Runs on early init through three interception layers, before themes and plugins load. Server load drops during attacks instead of spiking.</li>
<li><strong>Smarter CAPTCHA.</strong> 9 modes including Silent Auto-Verify – zero clicks for humans, hard wall for bots. Proprietary CAPTCHAs defeat AI-based solvers that crack reCAPTCHA for $2-3 per 1 000.</li>
<li><strong>Honest free version.</strong> Full firewall, all 9 CAPTCHA modes, full 2FA, full logging, full Multisite support. No nag screens, no crippled features.</li>
<li><strong>Privacy-first.</strong> No visitor data leaves your server. GDPR and CCPA compliant out of the box.</li>
<li><strong>Works with everything.</strong> Cloudflare, WP Rocket, LiteSpeed, WooCommerce, Elementor, multisite, IPv6, PHP 7.4 to 8.5.</li>
</ul>
<h4>🛡️ Core Firewall (Free)</h4>
<ul>
<li><strong>Three-Layer Architecture</strong> – intercepts traffic at wp-config.php (before WordPress), MU-plugin phase, and main shield. The first layer blocks known threats without loading WordPress at all, saving 30-100ms and 5-20MB RAM per blocked request.</li>
<li><strong>Web Application Firewall (WAF)</strong> with real-time rule updates via the BotBlocker Threat Defense Feed</li>
<li><strong>2 899 User-Agent signatures</strong> – largest blacklist among WordPress plugins – covering Scrapy, Selenium, Puppeteer, PhantomJS, curl, wget, Python, Java, Perl, and SQL injection tools</li>
<li><strong>Brute force protection</strong> with progressive lockouts – 5 attempts per 15 minutes, escalating bans for repeat offenders</li>
<li><strong>Anti-spam</strong> for comments, registration, contact forms – spammers blocked before they connect</li>
<li><strong>XML-RPC and REST API</strong> locked down by default with allowlist for trusted services</li>
<li><strong>Fake crawler detection</strong> via FCrDNS (dual-direction DNS verification), ASN tokens, and published IP ranges – 95% effective, impossible to spoof without controlling the provider’s DNS zone</li>
<li><strong>LLM / AI crawler management</strong> – allow or block GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Bytespider via CIDR-verified IP ranges. Trusted crawlers verified, impersonators blocked.</li>
<li><strong>Country, ASN, IP range, User-Agent, Referer</strong> blocking rules with instant enforcement</li>
<li><strong>Cloudflare-aware</strong> real-IP resolution and origin bypass protection</li>
<li><strong>Full IPv6 support</strong> – separate tables and logic for IPv4 and IPv6, every feature works with both</li>
<li><strong>Live traffic monitor</strong> with attack map, country, ASN, device, browser, and exact block reason for every request</li>
<li><strong>Built-in caching</strong> via Redis and Memcached – free, auto-disable on connection failure</li>
</ul>
<h4>🔒 Login Security & 2FA (Free)</h4>
<ul>
<li><strong>Two-Factor Authentication</strong> compatible with Google Authenticator, Authy, 1Password, Bitwarden – TOTP standard with 10 backup codes</li>
<li><strong>9 CAPTCHA modes</strong>: Silent Auto-Verify, Single Button, Color CAPTCHA, Images CAPTCHA, Shapes CAPTCHA (60fps Canvas), Digits CAPTCHA, Hold Button CAPTCHA, plus Google reCAPTCHA v2 and v3</li>
<li><strong>Hybrid Mode</strong> – combine any internal CAPTCHA with reCAPTCHA v3 for two-layer invisible defense</li>
<li><strong>Hide login URL</strong> <em>(PRO)</em></li>
<li><strong>Configurable lockout durations</strong> with escalation for repeat offenders – failed CAPTCHA triggers short ban, repeated failure triggers 24-hour ban</li>
</ul>
<h4>💳 Payment Gateway Bypass (Free)</h4>
<p>Auto-detects 25+ e-commerce platforms (WooCommerce, Easy Digital Downloads, SureCart, MemberPress, Paid Memberships Pro, Give, Dokan, CartFlows, FunnelKit, and more) and 150+ payment providers (Stripe, PayPal, Mollie, Adyen, Braintree, Square, Razorpay, Klarna, Paddle, Authorize.Net, 2Checkout, YooKassa, LiqPay, and more). <strong>Webhooks, IPN callbacks, and payment notifications never get blocked.</strong> Four detection layers ensure zero false positives on payment traffic.</p>
<h4>📊 Visibility & Control (Free)</h4>
<ul>
<li>Visual dashboard with attack map, top offenders, blocked-vs-allowed ratio, world traffic map</li>
<li>Detailed event log with IP, country, ASN, User-Agent, and exact block reason – 54 unique event codes</li>
<li>Health Score gauge – 42 parameters across 3 categories, 5 security levels from Critical to Secure</li>
<li>3 security presets – Light, Strong, Full – one-click configuration</li>
<li>Setup Wizard – 8 steps from welcome to test attack, setup in under 5 minutes</li>
<li>8 interface languages – English, Deutsch, Español, Français, Polski, Русский, Українська + POT template</li>
<li>Configurable retention with timezone and DST awareness</li>
<li>Clean uninstall – drops all 16 tables, removes 40+ options, clears cron hooks. Zero leftover data.</li>
</ul>
<h4>🚀 PRO Adds (Premium / Pro / Ultimate)</h4>
<ul>
<li>Real-time cloud threat intelligence cross-checked against global databases – 5M+ attack IPs, hundreds of thousands of bot signatures, updated daily</li>
<li>Zero-day behavioral and heuristic detection – catches unknown attack patterns before signatures exist</li>
<li>VPN, Tor, proxy, ASN, and hosting reputation checks</li>
<li>Early Init Mode – filtering before WordPress Core loads, maximum resource savings during attacks</li>
<li>Hide Login URL addon – custom admin URL, hardened wp-login.php protection</li>
<li>Security Headers addon – HSTS, CSP, X-Frame-Options, Permissions-Policy, Referrer-Policy, X-Content-Type-Options</li>
<li>Speed Up WordPress addon – 14 frontend and server optimizations</li>
<li>Malware Scanner addon – 25 patterns scanning files + 7 database tables, detects webshells, eval injections, base64-obfuscated code hidden in wp_options and post_content</li>
<li>Priority support – 24-hour response time</li>
</ul>
<p>Four plans to match your traffic: <strong>Premium</strong> ($12/month, 25k cloud checks), <strong>Pro</strong> ($50/month, 100k cloud checks), <strong>Ultimate</strong> ($100/month, 250k cloud checks + emergency 24h support). Annual billing includes 1 month free. 30-day refund policy. Licensed per domain, billed securely via Freemius.</p>
<p><a href="https://botblocker.top/pricing/" rel="nofollow ugc">Compare plans <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></p>
<h4>⚡ Performance & Compatibility</h4>
<ul>
<li><strong>Zero database queries</strong> for returning visitors – 9 runtime PHP files with SHA-256 integrity signatures, loaded via <code>include</code></li>
<li>Measured overhead: <strong>+3-15ms</strong> TTFB for cached visitors, <strong>+50-200ms</strong> for first-time PTR lookups, <strong>+2-4MB</strong> memory</li>
<li>Redis and Memcached support – free, auto-disables gracefully on connection failure</li>
<li><strong>Cache plugin compatibility</strong> – automatic <code>DONOTCACHEPAGE</code> and <code>Cache-Control: no-store</code> on verification pages. Works with WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, WP Fastest Cache, Cache Enabler</li>
<li><strong>CDN and WAF compatibility</strong> – Cloudflare, Sucuri, Incapsula, AWS CloudFront, Fastly, KeyCDN, StackPath. Multi-header real-IP resolution (CF-Connecting-IP, X-Forwarded-For, X-Real-IP)</li>
<li><strong>DDoS Protection Compatibility</strong> – automatic detection of JS-challenges from DDoS-Guard, Stormwall, Qrator. HMAC-signed AJAX responses, Circuit Breaker with automatic retry and backoff. BotBlocker is the only WordPress plugin that works correctly behind aggressive DDoS protection without manual configuration.</li>
<li><strong>Multisite Support</strong> – network activation, per-site data, per-site cleanup. Free on all plans.</li>
<li><strong>PHP 7.4 – 8.5</strong> – tested across 7 PHP versions. <strong>WordPress 5.0 – 7.0+</strong>. Linux and Windows.</li>
<li>GDPR and CCPA compliant – no PII collected, technical parameters only, Legitimate Interest basis (Art. 6(1)(f))</li>
</ul>
<h4>🤝 Trusted by</h4>
<ul>
<li>3 000+ active installations</li>
<li>Translated into 8 languages</li>
<li>Tested up to WordPress 7.0 and PHP 8.5</li>
<li>Developed and maintained by GLOBUS.studio</li>
</ul>
<blockquote>
<p>“Replaced two security plugins and a CAPTCHA plugin with one. Site is faster and the spam stopped overnight.” – WordPress.org user</p>
</blockquote>
<h3>Privacy</h3>
<p>BotBlocker Security does <strong>not</strong> collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.</p>
<h3>Support and Documentation</h3>
<ul>
<li>Product site: <a href="https://botblocker.top/products/" rel="nofollow ugc">https://botblocker.top/products/</a></li>
<li>Pricing and PRO plans: <a href="https://botblocker.top/pricing/" rel="nofollow ugc">https://botblocker.top/pricing/</a></li>
<li>Documentation: <a href="https://botblocker.top/docs/" rel="nofollow ugc">https://botblocker.top/docs/</a></li>
<li>Contact/support: <a href="https://botblocker.top/contacts/" rel="nofollow ugc">https://botblocker.top/contacts/</a></li>
<li>Community: <a href="https://botblocker.top/community/" rel="nofollow ugc">https://botblocker.top/community/</a></li>
</ul>
<h3>License</h3>
<p>This plugin is licensed under the GPLv2 or later. See LICENSE.txt for details.</p>
<h3>Credits & Authors</h3>
<p>BotBlocker Security is developed and maintained by GLOBUS.studio.</p>
<ul>
<li>Concept, architecture & code – Yevhen Leonidov: <a href="https://leonidov.dev/" rel="nofollow ugc">https://leonidov.dev/</a></li>
<li>Code, code review – Andrii Lukashevych</li>
<li>Code, translations – Aleksandr Kinakh</li>
</ul>
<p><strong>BotBlocker Security – The first line of defense for your WordPress site.</strong></p>


BotBlocker Security – Firewall & Bot Protection

Stop bots, brute force, spam, and fake crawlers before they reach WordPress. Three-layer firewall, 9 CAPTCHAs, FCrDNS, 2FA. Setup in 60 seconds.

ProgrammeLab

WP Ultimate Security

<h4>WORDPRESS SECURITY PLUGIN — PROTECTION WITHOUT THE COMPLEXITY</h4>
<p>Automated bots probe WordPress logins and forms around the clock. Ultimate Security shuts that down — with two-factor authentication, brute-force lockouts, anti-spam CAPTCHA, a hidden login URL, session controls, and security maintenance tools — all from a clean dashboard you do not need to be a security expert to run.</p>
<p>🎥 <strong>Watch a 2-minute intro:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/wip2sejhJkQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p>🛡️ <strong>Lightweight. Privacy-first. No bloat.</strong></p>
<h4>Why Ultimate Security?</h4>
<ul>
<li><strong>It just works.</strong> Sensible defaults out of the box — turn it on, you are safer in minutes.</li>
<li><strong>Built for real attacks.</strong> Stops the automated login, brute-force and spam traffic that actually hits WordPress sites.</li>
<li><strong>Zero learning curve.</strong> Plain-English settings, a Test Mode to preview rules before they go live.</li>
<li><strong>Privacy-respecting.</strong> No tracking, no data collection. Pro features are clearly labelled.</li>
</ul>
<p>🎥 <strong>Full Overview of Ultimate Security’s Dashboard:</strong></p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/efZo3vnMy_E?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h4>🔐 Login & Two-Factor Authentication</h4>
<ul>
<li><strong>Two-Factor Authentication (2FA)</strong> — Email one-time codes <strong>and</strong> authenticator apps via TOTP/HOTP. <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Setup docs</a> · <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">Video</a></li>
<li><strong>Per-user 2FA with role-based configuration options</strong> — Let users enable 2FA and configure which roles should use email or app-based 2FA.</li>
<li><strong>Brute-force login lockout</strong> — Limit failed attempts, auto-lock offenders, auto-reset retries, block specific users, and keep a recovery URL for emergencies.</li>
<li><strong>Custom login URL</strong> — Hide <code>wp-admin</code> / <code>wp-login.php</code> behind a secret address so bots cannot find it.</li>
<li><strong>Strong password policies</strong> — Enforce length, complexity, expiry and password history.</li>
<li><strong>Session control</strong> — Limit concurrent logins per user and harden auth cookies.</li>
</ul>
<h4>🤖 Bot & Brute-Force Protection</h4>
<ul>
<li><strong>Anti-spam CAPTCHA</strong> — Google reCAPTCHA v2/v3 <strong>and</strong> Cloudflare Turnstile.</li>
<li><strong>Form coverage</strong> — Protect WordPress login, registration and lost-password forms; Turnstile also supports comment forms; WooCommerce login/register forms are supported when enabled.</li>
<li><strong>No-conflict mode</strong> — Plays nicely alongside other CAPTCHA setups.</li>
</ul>
<h4>🧱 Security Maintenance & Controls</h4>
<ul>
<li>Rotate WordPress security keys / salts on demand.</li>
<li>Use the Update Manager to control WordPress core, plugin and theme update behavior.</li>
<li>Connect Cloudflare and deploy configurable WAF rule groups from the dashboard.</li>
<li>Review a basic Security Score with prioritized security checks.</li>
<li>Advanced hardening toggles, API privacy filtering and scheduled salt rotation are available in Pro.</li>
</ul>
<h4>📊 Monitoring & Tools</h4>
<ul>
<li><strong>Login Activity snapshot</strong> — Review recent successful and failed login activity from the dashboard.</li>
<li><strong>Basic Security Score</strong> — See a scored security posture based on enabled protections.</li>
<li><strong>Site Health snapshot</strong> — WordPress/PHP versions, memory, active plugins and theme at a glance.</li>
<li><strong>Test Mode</strong> — Simulate security rules and review what <em>would</em> have been blocked before enforcing.</li>
<li><strong>Settings backup & restore</strong> — Export/import your configuration as JSON for migrations or disaster recovery.</li>
</ul>
<p>👉 <strong><a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Check Out »</a></strong></p>
<h4>🛠️ Recommended setups by use case</h4>
<p>Different sites face different threats. Start with the profile that matches you, then layer on more from the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Solo blogger / personal site</strong> — Enable Email 2FA on the admin account, set a 5-attempt login lockout with a 15-minute cooldown, set a custom login URL, and add Cloudflare Turnstile to the comment form.</li>
<li><strong>Small agency / multi-author site</strong> — Require authenticator-app 2FA per role for editor and above, enforce password length + history, cap concurrent logins per user, and enable Test Mode before tightening rules.</li>
<li><strong>WooCommerce store</strong> — Add reCAPTCHA or Turnstile to login, registration and lost-password forms, set a custom login URL, enable brute-force lockout, and review Site Health weekly.</li>
<li><strong>Membership / community site</strong> — Per-user 2FA enabled site-wide, strong password policy, session limits to block account sharing, and CAPTCHA on registration to keep bot signups out.</li>
</ul>
<p>Each setup uses only free features. See the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">full setup guides</a> for step-by-step instructions.</p>
<h3>📖 Security terms in plain English</h3>
<p>New to WordPress security? Here is what the jargon means and why each one matters.</p>
<ul>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/email-otp/" rel="nofollow ugc">Two-Factor Authentication</a> (<a href="https://docs.wpultimatesecurity.com/docs/login-authentication/authentication-apps/" rel="nofollow ugc">2FA</a>)</strong> — A second proof of identity (a one-time code) on top of your password, so a stolen password alone cannot log in.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/brute-force-protection/login-attempts/" rel="nofollow ugc">Brute force</a></strong> — Automated tools that guess thousands of password combinations against your login form; lockouts cut them off after a few failures.</li>
<li><strong>CAPTCHA</strong> — A <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/google-recaptcha/" rel="nofollow ugc">small puzzle</a> or <a href="https://docs.wpultimatesecurity.com/docs/bot-protection/cloudflare-turnstile/" rel="nofollow ugc">invisible check</a> that confirms a real human is filling out a form, blocking most spam bots.</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/login-authentication/custom-login-url/" rel="nofollow ugc">Custom login URL</a></strong> — Moving your login page from the well-known <code>/wp-login.php</code> to a secret path so automated scanners cannot find it.</li>
<li><strong>Hardening</strong> — Turning off WordPress features attackers abuse but most sites do not need (file editor, XML-RPC, user enumeration, directory browsing).</li>
<li><strong><a href="https://docs.wpultimatesecurity.com/docs/security-keys/wordpress-security-keys/" rel="nofollow ugc">Salt rotation</a></strong> — Replacing the random secret keys in <code>wp-config.php</code> to invalidate stolen sessions and force re-login everywhere.</li>
<li><strong>Session control</strong> — Limiting how many places one account can be logged in at once and hardening the auth cookie.</li>
<li><strong>Test Mode</strong> — Previewing which requests a new rule would have blocked, before the rule starts blocking anything for real.</li>
</ul>
<p>Each term links to deeper reading in the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<h4>📚 Learn more</h4>
<ul>
<li>🌐 <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">Website</a> — features, articles and more.</li>
<li>📘 <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">Documentation</a> — setup guides, troubleshooting, and how-tos.</li>
<li>🎥 <a href="https://www.youtube.com/@wpultimatesecurity" rel="nofollow ugc">YouTube channel</a> — video walkthroughs and tutorials.</li>
</ul>
<h4>🎯 Featured guides</h4>
<p>Short, focused reads that get most sites secure in under an hour. All link into the <a href="https://docs.wpultimatesecurity.com/" rel="nofollow ugc">documentation</a>.</p>
<ul>
<li><strong>Set up Email 2FA for your admin account</strong> — the fastest single thing you can do to block account takeover.</li>
<li><strong>Add an authenticator app (TOTP/HOTP) for stronger 2FA</strong> — Google Authenticator, Authy, Microsoft Authenticator.</li>
<li><strong>Pick a safe custom login URL</strong> — what to choose, what to avoid, how to recover if you forget it.</li>
<li><strong>Add reCAPTCHA or Cloudflare Turnstile to your forms</strong> — including WooCommerce login and registration.</li>
<li><strong>Tune brute-force lockout without locking yourself out</strong> — sane attempt limits, lockout duration, allowlists.</li>
<li><strong>Rotate WordPress security keys (salts) safely</strong> — when to rotate, what it logs everyone out of, and how to schedule it.</li>
</ul>
<h3>🔗 Follow Ultimate Security</h3>
<ul>
<li>Website: <a href="https://www.wpultimatesecurity.com" rel="nofollow ugc">https://wpultimatesecurity.com/</a></li>
<li>Documentation: <a href="https://docs.wpultimatesecurity.com" rel="nofollow ugc">https://docs.wpultimatesecurity.com/</a></li>
<li>Blog: <a href="https://wpultimatesecurity.com/blogs" rel="nofollow ugc">https://wpultimatesecurity.com/blogs/</a></li>
<li>X (Twitter): <a href="https://x.com/WPUSecurity" rel="nofollow ugc">https://x.com/WPUSecurity</a></li>
<li>Facebook: <a href="https://facebook.com/wpultimatesecurity" rel="nofollow ugc">https://facebook.com/wpultimatesecurity/</a></li>
<li>YouTube: <a href="https://youtube.com/@wpultimatesecurity" rel="nofollow ugc">https://youtube.com/@wpultimatesecurity/</a></li>
<li>Instagram: <a href="https://instagram.com/wpultimatesecurity" rel="nofollow ugc">https://instagram.com/wpultimatesecurity/</a></li>
<li>LinkedIn: <a href="https://linkedin.com/company/wpultimatesecurity" rel="nofollow ugc">https://linkedin.com/company/wpultimatesecurity/</a></li>
<li>Threads: <a href="https://threads.com/@wpultimatesecurity" rel="nofollow ugc">https://threads.com/@wpultimatesecurity/</a></li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following third-party services, and only when you explicitly enable the related feature:</p>
<h4>Google reCAPTCHA</h4>
<ul>
<li>When: reCAPTCHA CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s reCAPTCHA response token and your site secret key.</li>
<li>Endpoint: https://www.google.com/recaptcha/api/siteverify</li>
<li>Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>When: Cloudflare Turnstile CAPTCHA protection is enabled.</li>
<li>Data sent: the visitor’s Turnstile response token and your site secret key.</li>
<li>Endpoint: https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>WordPress.org Secret-Key (Salt) API</h4>
<ul>
<li>When: you request rotation of WordPress security keys/salts.</li>
<li>Data sent: a request for randomly generated salt strings (no site or user data).</li>
<li>Endpoint: https://api.wordpress.org/secret-key/1.1/salt/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>WordPress.org Core Version Check</h4>
<ul>
<li>When: the Update Manager checks for available WordPress core updates.</li>
<li>Data sent: a standard WordPress core version-check request (no user data).</li>
<li>Endpoint: https://api.wordpress.org/core/version-check/1.7/</li>
<li>Privacy: https://wordpress.org/about/privacy/</li>
</ul>
<h4>Cloudflare API</h4>
<ul>
<li>When: you connect Cloudflare or deploy/view WAF rules.</li>
<li>Data sent: Cloudflare credentials/token, selected zone/rule data, and Cloudflare API requests needed for verification, deployment and analytics.</li>
<li>Endpoint: https://api.cloudflare.com/client/v4/</li>
<li>Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/</li>
</ul>


Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools

Block hackers, bots and brute-force attacks with 2FA, CAPTCHA, login protection, session controls, security tools and more.

BotBlocker Security – Firewall & Bot Protection vs Ultimate Security – Login Protection, 2FA, Anti-Spam CAPTCHA, Brute-Force & Security Tools