Know your traffic.
Choose what
gets through.
Layered bot detection and traffic controls for WordPress. Observe suspicious requests, tune your rules, and enable enforcement when you’re ready.
Make the decision
with context.
A new installation records would-be blocks without denying access. Review the log, adjust exemptions and thresholds, then choose an enforcing mode.
Try the mode selector. This is an illustrative preview, not a live security test.
One request.
A deliberate sequence of checks.
Guards run in order. The first decisive result wins; later checks do not override an earlier allow or block. Expand a layer to see its role.
01Allowlist & exemptions
Start with trusted IPs and CIDRs, authenticated users, exempt paths, and configured service signatures. WordPress still handles authentication.
02Legitimate crawler verification
Use cached forward-confirmed reverse DNS for supported search-engine bots. Background verification avoids synchronous DNS lookups during a visit.
03AI crawler controls
Manage individual AI crawlers. Supported operators are checked against published IP ranges; user-agent-only recognition is handled separately and can be rate-limited.
04Page & API rate limits
Configure separate request counts and time windows for page traffic and API/admin-ajax traffic. Defaults are 300 page requests and 120 API requests per minute per IP.
05User-agent detection
Recognize scanner and headless-browser signatures. Common HTTP libraries and short or empty user agents contribute to scoring rather than triggering a standalone user-agent block.
06Browser-claim checks
Compare claimed browser identity with expected request headers. By default, this check targets configured archive/listing URLs rather than every HTML page.
07Archive & listing rules
Restrict selected category, tag, author, topic, and entity archives to recognizable browsers or traffic allowed by earlier guards.
08Optional browser challenge
Serve an anonymous HTML visitor a JavaScript interstitial with a signed, short-lived cookie. Choose suspicious traffic or all eligible visitors. Off by default; capable automated browsers can pass it.
09Country blocking
Choose countries to block using trusted proxy signals, cached data, or a local country database. The blocked-country list starts empty.
10Optional risk scoring
Combine configured high-risk countries with a suspicion threshold. In this version, risk scoring requires both its own toggle and Geo Blocking to be enabled; it starts off.
Distinguish a crawler’s claim
from its verification.
Keep useful discovery in mind while defining access policies for automated traffic.
Verified where supported
Search-engine verification uses cached forward-confirmed reverse DNS. Supported AI crawler identities are checked against operator-published CIDR ranges, refreshed by scheduled maintenance.
Per-crawler choices
Manage individual crawlers, including GPTBot, OAI-SearchBot, ChatGPT-User, and Perplexity bots. Training-crawler options are individually configurable.
Recognition has limits
Some crawlers have only user-agent recognition. These can be rate-limited; a claimed name alone is not the same as verified identity.
Controls you can
review and maintain.
Protect page & API traffic
Set separate limits and windows for pages and API/admin-ajax requests. Tune them for shared networks and your site’s normal traffic.
Choose the response
Keep observing, show a 403 page, display your message, or use a configured redirect. API responses use JSON outside redirect mode.
Control location rules
Use trusted proxy headers and local GeoIP data. Remote lookup is off by default and requires both opt-in and consent.
Stay in control
Logged-in users, login screens, non-AJAX admin screens, and cron/CLI have bypass paths. An emergency disable switch and fail-open error handling support recovery.
Understand the reason
behind the flag.
The dashboard and filterable block log expose reasons, scores, request paths, user agents, IPs, and available country data. Log-only mode makes those records a tuning tool.
Choose your logging driver
Use database logging or flat files, with file-to-database sync for reporting.
Keep maintenance scheduled
Retention cleanup, file rotation, crawler-range refreshes, and background verification keep operational work outside routine page rendering where possible.
| Request | Reason | Mode |
|---|---|---|
| /category/news/ | Non-browser listing | Observe |
| /wp-json/… | Rate limit exceeded | Observe |
| /article/… | Scanner signature | Observe |
Start with evidence.
Build the policy from there.
Install & observe
Activate the plugin and keep log-only mode. Review requests that would be blocked, including integrations and expected crawlers.
Tune & verify
Adjust exemptions, proxy settings, rate limits, archive paths, and crawler policies. Confirm that scheduled maintenance runs.
Enforce & review
Choose an enforcing response, monitor the log, and refine your policy as traffic changes. Return to observation when needed.
Know where protection runs.
Bot Shield operates inside WordPress/PHP. A CDN or full-page cache can serve a response before PHP runs, bypassing these checks. Front-end coverage depends on your cache configuration; edge-level filtering may also be needed.
Clear expectations.
Better deployment.
Does activation immediately block visitors?
No. A fresh installation starts in log-only mode. Suspicious requests are recorded and allowed through until you choose enforcement. The optional JavaScript challenge does not serve an interstitial in log-only mode.
Does it stop every bot or a large DDoS attack?
No. Signatures, headers, rate limits, and JavaScript checks have limits. A capable automated browser can pass a JavaScript challenge. Bot Shield is a WordPress traffic-control layer, not a replacement for hosting, CDN, or network protections.
Are visitor IPs sent to a location provider?
Remote GeoIP is disabled by default. Enabling both remote lookup and consent can send visitor IPs to a configured provider. Local logs also contain request information; configure retention to match your needs.
Does it include automatic browser fingerprint collection?
No. Fingerprint and JavaScript timing helpers are developer-invoked. A developer must collect and supply those signals; the plugin does not automatically run those checks on every visitor.
What does it need to run?
The plugin header specifies WordPress 6.0 or later and PHP 7.4 or later. A persistent object cache is recommended; a file-based rate limiter is available without one. Multisite settings, logs, and storage are scoped per site.
How can I get Bot Shield?
Contact Wiz Consults for availability, a walkthrough, and help assessing your hosting and traffic configuration.
Build a traffic policy
that fits your website.
Talk to Wiz Consults about observation, configuration, and a controlled rollout.