jtzl

JTZL’s Bot Maze protects your WordPress site from unwanted AI crawlers and scrapers by planting invisible trap links that only bots will follow. When a bot enters the trap maze, it gets lost in an ever-expanding maze of realistic-looking fake pages while it quietly builds a suspicion score based on its behavior.
How it works:
<ol>
<li>Trap link injection — Invisible links are added to your real pages. Legitimate visitors never see them, but bots following every link on the page will enter the trap maze.</li>
<li>Lazy maze generation — Trap pages link to more trap pages, generated on demand. The deeper a bot goes, the more time it wastes.</li>
<li>Bot scoring — Each trap page visit adds suspicion points. Deeper traversal earns bonus points. Once a threshold is reached, the visitor is flagged as a bot.</li>
<li>Blocking and tarpitting — Flagged bots can be blocked outright (403), served decoy pages (light tarpit), or slowed down with a deliberate delay (full tarpit).</li>
<li>Crawler verification — Known search engine crawlers (Googlebot, Bingbot, etc.) are verified via reverse DNS and exempted from scoring.</li>
</ol>
Features:
<ul>
<li>Zero impact on legitimate visitors — trap links are hidden from humans and search engines</li>
<li>Configurable injection method (content, footer, or both)</li>
<li>Adjustable scoring thresholds and blocking behavior</li>
<li>robots.txt integration to signal trap paths as disallowed</li>
<li>Analytics dashboard showing bot activity, top IPs, and score distribution</li>
<li>Blocked Bots detail page showing full user agent, score, visit history</li>
<li>Optional comprehensive tracking mode to monitor blocked bot persistence</li>
<li>Automatic log retention and maintenance via WP-Cron</li>
<li>Privacy policy suggestion for GDPR compliance</li>
<li>Geographic heat map of bot activity by country with two GeoIP provider options</li>
<li>MaxMind GeoLite2 local database — all lookups on your server, GDPR-friendly (recommended)</li>
<li>ip-api.com external API — simple setup, no license key required</li>
<li>Lightweight — minimal footprint, geographic tracking is fully optional</li>
</ul>
<h3>Third-Party Services</h3>
This plugin offers optional geographic tracking with two provider options. No data is sent to any external service unless a site administrator explicitly enables one of these providers.
<h4>MaxMind GeoLite2 (Recommended)</h4>
When MaxMind GeoLite2 is selected as the GeoIP provider (Settings > Bot Maze > Geographic Tracking), the plugin downloads the GeoLite2-Country database from MaxMind and performs all IP-to-country lookups locally. No visitor data leaves your server.
<ul>
<li>What is downloaded: The GeoLite2-Country database (~60 MB), updated weekly via WP-Cron.</li>
<li>What is sent to MaxMind: Only your license key during database downloads. No visitor IP addresses are shared.</li>
<li>Requires: A free MaxMind license key from <a href="https://www.maxmind.com/en/geolite2/signup" rel="nofollow ugc">maxmind.com/en/geolite2/signup</a>.</li>
<li>Service website: <a href="https://www.maxmind.com" rel="nofollow ugc">https://www.maxmind.com</a></li>
<li>License: GeoLite2 databases are licensed under <a href="https://creativecommons.org/licenses/by-sa/4.0/" rel="nofollow ugc">CC BY-SA 4.0</a>.</li>
<li>Terms of service: <a href="https://www.maxmind.com/en/geolite2/eula" rel="nofollow ugc">https://www.maxmind.com/en/geolite2/eula</a></li>
</ul>
<h4>ip-api.com</h4>
When ip-api.com is selected as the GeoIP provider, the plugin sends visitor IP addresses to <a href="http://ip-api.com" rel="nofollow ugc">ip-api.com</a> to resolve their country of origin. This data is used to display a geographic heat map of bot activity in the admin dashboard.
<ul>
<li>What is sent: The visitor’s IP address only, over unencrypted HTTP.</li>
<li>When it is sent: At the time a trap page visit is recorded, only while this provider is selected.</li>
<li>Service website: <a href="http://ip-api.com" rel="nofollow ugc">http://ip-api.com</a></li>
<li>Terms of service: <a href="https://ip-api.com/docs/legal" rel="nofollow ugc">https://ip-api.com/docs/legal</a></li>
<li>Privacy policy: ip-api.com does not log queries from the free API endpoint.</li>
<li>Note: The free tier only supports HTTP (not HTTPS). If your site must comply with GDPR, use the MaxMind local database option instead.</li>
</ul>
Geographic tracking is off by default and requires explicit opt-in by a site administrator.

JTZL's Bot Maze

AI bot protection through invisible trap link mazes — hidden links lure bots into a maze of fake content for detection and blocking.

Syrow

This plugin allows you to easily integrate the Syrow Care code into your WordPress website.

Syrow Care

A simple yet powerful plugin that allows you to insert the Syrow Care code into your WordPress website.

JTZL's Bot Maze vs Syrow Care