English · Deutsch · Español · Français · Polski · Português · Русский · Українська · العربية · 中文 · 日本語
WordPress Firewall & Bot Protection
Stop bots, brute force, spam, and fake crawlers - before they reach WordPress.
Website · WordPress.org · Documentation · Pricing · Community
BotBlocker Security blocks 99% of automated attacks before WordPress even loads. No bloat, no slowdowns, no monthly fees for core protection. Setup in 60 seconds.
Three interception layers stop bad traffic at wp-config.php (before WordPress), MU-plugin phase, and the main shield - saving 30–100ms and 5–20MB RAM per blocked request. Competitors react after WordPress boots; BotBlocker stops threats at the door.
3,000+ active installations · 8 languages · GDPR / CCPA compliant · Works with Cloudflare, WP Rocket, LiteSpeed, WooCommerce, Elementor, multisite, IPv6
- Three-layer firewall with real-time WAF rule updates
- 2,899 User-Agent signatures - largest blacklist among WordPress plugins
- Brute force protection with progressive lockouts and escalating bans
- Anti-spam for comments, registration, and contact forms
- Fake crawler detection via FCrDNS - 95% effective, impossible to spoof
- LLM / AI crawler management - allow or block GPTBot, ClaudeBot, PerplexityBot, Bytespider
- Country, ASN, IP range, User-Agent, Referer blocking rules
- Cloudflare-aware real-IP resolution and origin bypass protection
- Full IPv6 support - separate tables and logic for IPv4 and IPv6
- DDoS protection auto-detection - JS-challenge recognition for DDoS-Guard, Stormwall, Qrator. The only WordPress plugin that works behind aggressive DDoS protection without manual whitelisting
- Two-Factor Authentication - TOTP standard (Google Authenticator, Authy, Bitwarden)
- 9 CAPTCHA modes:
- Silent Auto-Verify -- real users pass automatically with zero clicks, bots see "Access denied"
- Shapes CAPTCHA -- 60fps Canvas with moving geometric figures, ~100x harder for AI to crack than reCAPTCHA
- Color CAPTCHA -- select the correct color combination
- Images CAPTCHA -- visual recognition challenge
- Digits CAPTCHA -- numeric verification
- Hold Button CAPTCHA -- press-and-hold human verification
- Single Button CAPTCHA -- one-click verification
- reCAPTCHA v2 -- Google's "I'm not a robot"
- reCAPTCHA v3 -- invisible score-based verification
- Hybrid CAPTCHA -- combine any internal CAPTCHA with reCAPTCHA v3 for two-layer invisible defense
- Hide login URL(PRO)
Auto-detects 25+ e-commerce platforms and 150+ payment providers (Stripe, PayPal, WooCommerce, etc.). Webhooks and IPN callbacks never get blocked.
- Live traffic monitor with attack map and 54 unique event codes
- Health Score gauge - 42 parameters, 5 security levels
- 8 interface languages - English, Deutsch, Español, Français, Polski, Русский, Українська
- Clean uninstall - zero leftover data
| Feature | Free | Premium | Pro | Ultimate |
|---|---|---|---|---|
| Real-time visitor statistics | ✓ | ✓ | ✓ | ✓ |
| MU-Mode | ✓ | ✓ | ✓ | ✓ |
| Brute-force protection | ✓ | ✓ | ✓ | ✓ |
| Fake crawler detection (FCrDNS) | ✓ | ✓ | ✓ | ✓ |
| Local bot blocking | ✓ | ✓ | ✓ | ✓ |
| Redis / Memcached integration | ✓ | ✓ | ✓ | ✓ |
| Early Init Mode | -- | ✓ | ✓ | ✓ |
| Cloud IP intelligence | -- | ✓ | ✓ | ✓ |
| Zero-day botnet updates | -- | ✓ | ✓ | ✓ |
| 5M+ bots signatures | -- | ✓ | ✓ | ✓ |
| Behavioral analysis engine | -- | ✓ | ✓ | ✓ |
| Cloud checks / month | -- | 25k | 100k | 250k |
| Unlock Addons | -- | ✓ | ✓ | ✓ |
| Priority support | -- | ✓ | ✓ | ✓ |
| Emergency support (24h) | -- | -- | -- | ✓ |
| Monthly price | Free | $12 | $50 | $100 |
| Annual price | Free | $11/mo | $45.8/mo | $91.6/mo |
Annual billing includes 1 month free. Licensed per domain via Freemius. Compare plans →
| BotBlocker | Typical security plugins | |
|---|---|---|
| Interception point | Before WordPress loads | After WordPress boots |
| CPU/RAM per blocked request | 30–100ms / 5–20MB RAM saved | Full WordPress stack loaded |
| CAPTCHA modes | 9 (proprietary + reCAPTCHA) | 1–2 (reCAPTCHA only) |
| AI-resistant CAPTCHA | Yes -- Shapes ~100x harder to crack than reCAPTCHA (crackable for $2-3/1,000) | No |
| Free tier limits | None - full firewall, all CAPTCHAs, full 2FA | Crippled features, nag screens |
| Privacy | All data stays on your server | Telemetry, external API calls |
| Measured overhead | +3–15ms for verified visitors | +20–200ms |
- PHP 7.4–8.5
- WordPress 5.1–7.0+
- Platform Linux, Windows, shared hosting
- Database Zero DB queries for returning visitors - 9 pre-generated PHP runtime files
- Cache Redis / Memcached support (auto-disable on failure)
- CDN / DDoS Cloudflare, Sucuri, StackPath, DDoS-Guard, Stormwall compatible
- License GPL-2.0+
Built by GLOBUS.studio · Yevhen Leonidov · Andrii Lukashevych · Aleksandr Kinakh