Omajemite Don

BotFend Anti-Bot Firewall is a professional-grade WordPress security suite designed to stop automated attacks, malicious bots, and brute-force attempts before they consume your server resources. Built with a high-performance V4 architecture, it features a smart aggregation engine and an early-loading Web Application Firewall (WAF) that neutralizes threats at the server level.
Developed by Omajemite Don, BotFend protects your site without slowing it down.
<h3>Core Features:</h3>
<ul>
<li>Advanced Web Application Firewall (WAF): Uses <code>auto_prepend_file</code> via <code>.htaccess</code> or <code>.user.ini</code> to block attacks before WordPress even loads.</li>
<li>Intelligent Bot Detection: Identifies and blocks malicious bots, crawlers, and scrapers using advanced signature detection.</li>
<li>Behavioral Analysis: Monitors visitor behavior patterns to detect and block automated threats that mimic human activity.</li>
<li>Browser Fingerprinting: Generates unique browser fingerprints to track and identify persistent attackers across sessions and IP changes.</li>
<li>Advanced 404 Detection: Detects and blocks malicious path scanning, vulnerability probing, and excessive 404 abuse patterns.</li>
<li>WordPress Protection: Comprehensive protection against XML-RPC attacks, REST API abuse, author scanning, and WordPress-specific vulnerabilities.</li>
<li>Signature Detection: Real-time pattern matching against known attack signatures and malicious payloads.</li>
<li>Smart Log Aggregation: High-performance database architecture that centralizes logging to prevent database bloat and memory crashes, even under heavy attack.</li>
<li>Perpetual Offender Tracking: Automatically upgrades temporary bans to permanent blocks for IPs that repeatedly attack your site.</li>
<li>Real-Time Threat Intelligence: Integrates with external databases to verify IP reputations on the fly.</li>
<li>Tor Node Blocking: Automatically detects and blocks malicious traffic originating from the Tor anonymity network.</li>
<li>Comprehensive UI: Clean, intuitive WordPress admin interface with bulk actions, detailed threat analysis timelines, and visual statistics.</li>
</ul>
<h3>Pro Features (Available with License):</h3>
<ul>
<li>Full Firewall Auto Prepend: Execute firewall protection at the earliest possible stage of WordPress execution</li>
<li>Cloudflare Integration: Synchronize blocked IPs to Cloudflare firewall rules at the edge, blocking attacks before they reach your server</li>
</ul>
<h3>External Services</h3>
IMPORTANT: All external services are DISABLED BY DEFAULT. You must explicitly enable each service in the plugin settings before any data is sent.
This plugin can connect to the following external services to provide enhanced threat protection. No data is sent unless you explicitly enable these features.
<h3>1. AbuseIPDB API</h3>
<ul>
<li>Purpose: Checks the reputation of suspicious IP addresses against a global database of reported abusers</li>
<li>Data sent: The IP address of the visitor being checked</li>
<li>When: When AbuseIPDB integration is enabled AND an IP address needs verification (cached for 24 hours)</li>
<li>How to disable: Set “Enable AbuseIPDB” to OFF in plugin settings (default: OFF)</li>
<li>Terms of Service: https://www.abuseipdb.com/legal</li>
<li>Privacy Policy: https://www.abuseipdb.com/privacy</li>
</ul>
<h3>2. IPHub API</h3>
<ul>
<li>Purpose: Detects VPNs, proxies, and non-residential IP addresses</li>
<li>Data sent: The IP address of the visitor being checked</li>
<li>When: When IPHub integration is enabled (default: OFF)</li>
<li>How to disable: Set “Enable IPHub” to OFF in plugin settings (default: OFF)</li>
<li>Terms of Service: https://iphub.info/legal/terms</li>
<li>Privacy Policy: https://iphub.info/legal/privacy</li>
</ul>
<h3>3. IP Geolocation Services</h3>
<ul>
<li>Purpose: Determine the country of origin for IP addresses to apply geographic blocking rules</li>
<li>Data sent: The IP address of the visitor being geolocated</li>
<li>When: When geolocation is enabled (default: OFF) AND an IP needs geolocation (results cached)</li>
<li>How to disable: Set “Enable IP Geolocation” to OFF in plugin settings (default: OFF)</li>
<li>Services used:</li>
</ul>
<h4>ip-api.com</h4>
<ul>
<li>Purpose: Primary geolocation service</li>
<li>Terms: https://ip-api.com/terms</li>
<li>Privacy: https://ip-api.com/privacy</li>
</ul>
<h4>ipapi.co</h4>
<ul>
<li>Purpose: Fallback geolocation service</li>
<li>Terms: https://ipapi.co/terms/</li>
<li>Privacy: https://ipapi.co/privacy/</li>
</ul>
<h4>ipwhois.io</h4>
<ul>
<li>Purpose: Secondary fallback geolocation service</li>
<li>Terms: https://ipwhois.io/terms</li>
<li>Privacy: https://ipwhois.io/privacy</li>
</ul>
<h3>4. Tor Project Exit List</h3>
<ul>
<li>Purpose: Downloads the official list of active Tor exit nodes to block anonymous attacks</li>
<li>Data sent: None (only downloads a public list)</li>
<li>When: Every 6 hours when Tor blocking is enabled (default: OFF)</li>
<li>How to disable: Set “Enable Tor Blocking” to OFF in plugin settings (default: OFF)</li>
<li>Service URL: https://check.torproject.org/torbulkexitlist</li>
<li>Terms of Use: https://www.torproject.org/about/trademark/</li>
<li>Privacy Policy: https://www.torproject.org/about/privacy_policy/</li>
</ul>
<h3>5. dan.me.uk Tor List (Alternative Source)</h3>
<ul>
<li>Purpose: Alternative source for Tor exit node list when primary source is unavailable</li>
<li>Data sent: None (only downloads a public list)</li>
<li>When: Only used as fallback when primary Tor list fails and Tor blocking is enabled</li>
<li>How to disable: Disable Tor blocking in plugin settings (default: OFF)</li>
<li>Service URL: https://www.dan.me.uk/torlist/</li>
<li>Terms/Privacy: This is a public service with no formal terms or privacy policy. Use is governed by standard HTTP protocol.</li>
</ul>
<h3>6. Threat Intelligence Feeds</h3>
<ul>
<li>Purpose: Download curated lists of known malicious IP addresses</li>
<li>Data sent: None (only downloads public blocklists)</li>
<li>When: When threat intelligence is enabled (default: OFF) and feeds need refreshing</li>
<li>How to disable: Set “Enable Threat Intelligence” to OFF in plugin settings (default: OFF)</li>
<li>Feeds used:
<ul>
<li>FireHOL: https://firehol.org/ (Public domain blocklists)</li>
<li>Blocklist.de: https://www.blocklist.de/ (Terms: https://www.blocklist.de/en/terms.html)</li>
<li>Emerging Threats (Proofpoint): Real-time threat intelligence feeds</li>
<li>Terms: https://www.proofpoint.com/us/legal/license</li>
<li>Privacy: https://www.proofpoint.com/us/legal/privacy-policy</li>
</ul>
</li>
</ul>
<h3>7. Google reCAPTCHA</h3>
<ul>
<li>Purpose: Provides bot verification on login, registration, and comment forms</li>
<li>Data sent: Browser interaction data sent to Google’s servers</li>
<li>When: When reCAPTCHA is enabled AND a user interacts with a protected form</li>
<li>How to disable: Set reCAPTCHA site key and secret key to empty in plugin settings</li>
<li>Terms of Service: https://policies.google.com/terms</li>
<li>Privacy Policy: https://policies.google.com/privacy</li>
</ul>
<h3>8. Cloudflare API Integration (PRO VERSION)</h3>
<ul>
<li>Purpose: Synchronize blocked IPs to Cloudflare firewall rules at the edge, blocking attacks before they reach your server</li>
<li>Data sent: IP addresses, threat scores, authentication credentials, and configuration parameters during API calls</li>
<li>When: During manual sync operations, scheduled automatic syncs, and license validation</li>
<li>How to disable: Available only in Pro version with valid license</li>
<li>Terms of Service: https://www.cloudflare.com/terms/</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h3>Data Handling Summary</h3>
<ul>
<li>No data is sent to any external service unless you explicitly enable that feature</li>
<li>All API results are cached to minimize external requests</li>
<li>Regular visitor IPs are never sent – only suspicious or attacking IPs trigger external lookups</li>
<li>You can disable ALL external services in the plugin settings</li>
<li>Plugin works perfectly with all external services disabled</li>
</ul>
<h3>Privacy</h3>
This plugin respects user privacy: 
– No tracking of regular site visitors 
– No analytics or usage data collected 
– All external services are opt-in (disabled by default) 
– Full transparency: All external service calls are documented above

BotFend Anti-Bot Firewall

Professional security plugin protecting WordPress from malicious bots, spam, and server attacks using an advanced Web Application Firewall.

POTAR

Checkout Origin Guard protects your WooCommerce store from fake, fraudulent, or automated checkout attempts by identifying and blocking abusive origins before they clutter your order table or your logs.
The plugin runs client-origin heuristics, IP controls, and sequence analysis to detect non-human traffic and suspicious behavior at checkout. It adds Company Shield for business and email sanity checks and an optional AVS “U” signal handler for gateways that report “Address not checked / unavailable”.
All controls live on a single admin screen; you can adjust sensitivity, manage allowlists and blocklists, and review traffic logs in one place.
<h3>Three layers of protection</h3>
<ol>
<li>
Bot Block (traffic level) 
Detects and throttles abusive requests before they become orders:
<ul>
<li>Analyzes user agents, referrers, and known bot signatures </li>
<li>Watches rapid-fire hits to checkout and wc-ajax endpoints </li>
<li>Supports monitor, soft, and hard blocking modes </li>
<li>Built-in allowlist for search engines, uptime monitors, and core WordPress services</li>
</ul>
</li>
<li>
Company Shield (checkout level) 
Validates business identity and email quality at checkout:
<ul>
<li>Flags suspicious or synthetic business names </li>
<li>Detects repeated syllables, odd vowel ratios, and gibberish patterns </li>
<li>Identifies disposable email domains and role-based accounts (admin, info, sales, etc.) </li>
<li>Can run in:
<ul>
<li>Monitor; log and annotate orders </li>
<li>Soft; create the order and automatically place it on hold or pending </li>
<li>Hard; block checkout with a user-facing error message</li>
</ul>
</li>
</ul>
</li>
<li>
Payment AVS signals (post-payment; optional) 
For gateways that expose AVS results in order meta, Checkout Origin Guard can treat “AVS: U; unavailable / not checked” as a risk signal:
<ul>
<li>Does not change how your gateway authorizes or captures payments </li>
<li>Can be configured to:
<ul>
<li>Ignore the signal </li>
<li>Add an order note only </li>
<li>Add an order note and bump a risk-score meta field </li>
<li>Put the order on hold for manual review </li>
</ul>
</li>
<li>Uses flexible pattern matching; can scan specific gateway meta keys or fall back to scanning all order meta for common “AVS: U” messages such as the PayPal string </li>
<li>Off by default; you opt in and choose the behavior</li>
</ul>
</li>
</ol>
<h3>Key Features</h3>
<ul>
<li>🛡️ Bot Block; Detects and blocks automated bots by analyzing user agents, referrers, and checkout behavior patterns.</li>
<li>⚡ Rapid Sequence Detection; Monitors frequency and timing between checkout attempts to identify scripted attacks and card testing activity.</li>
<li>🧠 Company Shield; Flags suspicious or AI-generated business names, email domains, and mixed-character spam entries at checkout.</li>
<li>🌎 Allowlist Controls; Preserve access for search engines, uptime monitors, and essential WordPress and WooCommerce services.</li>
<li>🔒 Hard / Soft / Monitor Modes; Choose between logging only, soft blocking, or full hard blocking.</li>
<li>🧾 AVS “U” Risk Signals (optional); Treat “Address not checked / unavailable” as a post-payment risk signal; add notes, increase risk score, or hold the order.</li>
<li>🗂️ Log Viewer; See activity including timestamps, IPs, user agents, paths, and detection outcomes.</li>
<li>🧩 One-Page Dashboard; Configure settings, review logs, and manage allow/deny lists from a single screen.</li>
<li>🚫 Manual Block / Unblock; Instantly remove or restore access for specific IPs with one click.</li>
<li>💾 CSV Export; Download checkout-origin activity logs for security review or record keeping.</li>
</ul>
<h3>Why Online Shops Need it</h3>
WooCommerce checkouts are frequent targets for:
<ul>
<li>Card testing and BIN probing </li>
<li>Fake business registrations and spam accounts </li>
<li>Automated scripts hammering your checkout endpoints </li>
</ul>
Checkout Origin Guard focuses on checkout behavior and identity quality, not just generic firewall rules. It helps you:
<ul>
<li>Reduce chargeback and fraud risk </li>
<li>Keep your order list clean and reviewable </li>
<li>Shorten the time spent cleaning up junk orders and bogus signups </li>
</ul>
The plugin works alongside any existing firewall, CDN, or WAF; it does not rely on external APIs or subscriptions. All data stays on your server.
<h3>Use Cases</h3>
<ul>
<li>Prevent card testing or order spam </li>
<li>Stop bots using nonsense or AI-generated company names </li>
<li>Detect rapid repeat checkout attempts from the same IP </li>
<li>Block suspicious POST requests that hit checkout endpoints </li>
<li>Add an extra layer of review for orders where the gateway reports “AVS unavailable / not checked” </li>
<li>Maintain cleaner order history and logs for real customers</li>
</ul>
<h3>Credits</h3>
Developed by Michael Winchester 
For documentation and updates, visit https://michaelwinchester.com

Checkout Origin Guard

One-page WooCommerce checkout hardening; bot blocking, rate/sequence checks, business/email heuristics, and optional AVS-based risk signals.

BotFend Anti-Bot Firewall vs Checkout Origin Guard