Bot Lockout

Bot Lockout is a security plugin that implements a lightweight cryptographic challenge system to distinguish between real browsers and automated bots. Unlike traditional CAPTCHA systems, it uses JavaScript-based cryptographic operations that are easy for humans but difficult for most bots to solve.

Key Features

• Lightweight Protection : Uses minimal resources and doesn’t impact site performance
• Cryptographic Challenges : SHA-256 hashing with date and user agent binding
• Smart Whitelisting : Allow trusted bots (Google, Bing, etc.) and IP addresses
• Flexible Configuration : Exclude specific pages and customize block messages
• Comprehensive Logging : Track blocked attempts for analysis
• Custom Styling : Add custom CSS to match your site’s design
• Daily Token Expiration : Prevents long-term bypass attempts

How It Works

1. 01Initial Request : When a visitor accesses your site, the plugin checks for a valid challenge token
2. 02JavaScript Challenge : If no token exists, a cryptographic challenge is presented
3. 03Token Generation : The challenge combines the current date with the user agent string and creates a SHA-256 hash
4. 04Secure Storage : The hash is base64 encoded, truncated, and stored as a secure cookie
5. 05Validation : Subsequent requests are validated against the stored token

Security Features

• Cryptographically Secure : Uses SHA-256 hashing algorithm
• Time-Bound : Tokens expire daily to prevent long-term bypass
• Browser-Specific : User agent binding prevents token sharing
• Secure Cookies : Implements proper cookie security settings