Is BotBlocker Security really free?
Yes. The free version includes: three-layer firewall, all CAPTCHA modes, anti-detect scoring, FCrDNS bot verification, rate limiting, 2FA with backup codes, anti-spam, brute-force protection, XML-RPC and REST API protection, live traffic monitor, Telegram alerts, shortcodes, diagnostic tools, command palette, Redis/Memcached, Multisite support, and DDoS compatibility. PRO adds cloud threat intelligence, Early Init Mode, premium addons (Hide Login, Security Headers, Speed Up, Malware Scanner, Behavioral Analysis, and more), and priority support. Premium starts at $12/month.
Will it slow down my site?
No. Measured overhead is +3-15ms for verified visitors with zero database queries – all rules load from pre-generated PHP files with SHA-256 integrity. Under attack, server load typically drops because bad requests are rejected at the earliest interception layer, before WordPress, PHP, or database code runs. FULL mode saves 30-100ms and 5-20MB RAM per blocked request.
Does it work with Cloudflare or a CDN?
Yes. BotBlocker reads proxy headers (CF-Connecting-IP, X-Forwarded-For, X-Real-IP) to find the real client IP and blocks attempts to bypass Cloudflare by hitting your origin directly. Fully compatible with Cloudflare, Sucuri, Incapsula, AWS CloudFront, Fastly, KeyCDN, and StackPath.
Cloudflare Business+ users can also enable TLS fingerprinting (JA3/JA4) for bot detection – see docs/TLS-FINGERPRINTING.md .
Does it work with WooCommerce and payment gateways?
Yes. Auto-detection for e-commerce platforms and payment providers. Stripe, PayPal, Mollie, Adyen, Razorpay, YooKassa, and other webhooks are automatically recognized and never blocked. Detection layers (path patterns, query keys, action names, signature headers) ensure zero interference with payment processing. Bypass modes (full/partial), settings and hardening recommendations: see docs/PAYMENT-BYPASS.md .
Does it work with caching plugins?
Yes. BotBlocker automatically sets DONOTCACHEPAGE and multiple cache-bypass headers ( Cache-Control: no-store , X-LiteSpeed-Cache-Control , X-Accel-Expires , CDN-Cache-Control , Surrogate-Control ) on verification pages so PHP-based caches, Nginx reverse proxies, CDN edges, and surrogate caches never store security barriers. Works out of the box with WP Super Cache (PHP mode), W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, WP Fastest Cache, Cache Enabler, and Swift Performance. Server-level caches (Nginx FastCGI, Varnish) need a cookie-based bypass rule – see docs/CACHE-COMPATIBILITY.md .
Does it work behind DDoS-Guard, Stormwall, or similar services?
Yes. Since version 1.6.13, BotBlocker auto-detects JS-challenges from external DDoS protection services. HMAC-signed AJAX responses let the plugin distinguish its own responses from DDoS-provider challenge pages. Circuit Breaker prevents retry storms (3 failures → 30-second cooldown). BotBlocker is the only WordPress security plugin that works correctly behind aggressive DDoS protection without manual whitelisting. See docs/DDOS-COMPATIBILITY.md .
Will it lock me out?
No. BotBlocker auto-detects your server IP during setup and lets you allowlist admin IPs and trusted services. WP-Cron and internal WordPress calls always pass. If you ever get locked out, a hashed Secret URL (generated in the admin panel and sent to the admin email) provides emergency access – no FTP required.
Does it collect visitor data?
No. Only technical request parameters (IP, headers, User-Agent) are analyzed locally on your server. No PII is stored or sent anywhere. GDPR-compliant under Legitimate Interest (Art. 6(1)(f)). CCPA compliant – no PII collection, no data sale. Full details in docs/PRIVACY.md .
Does it support IPv6?
Yes. Every feature works with IPv4, IPv6, or dual-stack setups. Separate database tables and logic for each protocol family.
Does it support multisite?
Yes, since version 1.6.15. Network activation, per-site data isolation, per-site settings, and per-site cleanup on uninstall. Free on all plans.
Will it conflict with Wordfence, Sucuri, or other security plugins?
BotBlocker is designed to coexist. It operates very early in the request lifecycle and typically works alongside other plugins. The only thing to avoid is enabling the same CAPTCHA twice on the same form. Most users replace their previous security stack entirely.
Which CAPTCHA should I choose?
Silent Auto-Verify is the recommended default. Real users pass with zero clicks via JavaScript fingerprint checks behind the scenes – they see nothing. Bots see “Access denied.” For login pages, combine Silent Mode with reCAPTCHA v3 in Hybrid Mode for two-layer invisible defense. Shapes CAPTCHA (60fps Canvas with moving geometric figures) is the strongest against AI-based CAPTCHA solvers – it requires real-time computer vision, making it roughly 100x more expensive to crack than standard reCAPTCHA.
How does BotBlocker verify search engine bots?
Through FCrDNS (Forward-confirmed Reverse DNS) – the same method used by Cloudflare Bot Management, DataDome, and Akamai Bot Manager. Googlebot is verified via PTR (.googlebot.com) + ASN (15169). YandexBot uses triple verification (PTR + ASN 13238 + IP CIDR). Facebook gets dual verification (PTR + ASN 32934). Multi-resolver DNS fallback for reliability. 95% effective against fake crawlers – you cannot spoof FCrDNS without controlling the provider’s DNS zone.
Does BotBlocker use honeypots?
Yes – several kinds, layered at different levels:
- Challenge page decoys. CAPTCHA modes render invisible decoy buttons with generated class names and styles ( display:none on random per-request hashes). Clicking a decoy submits a wrong challenge hash and the request is rejected. Decoys are re-generated per request, so bot patterns cannot be hardcoded.
- Hidden autofill trap. The check page contains a CSS-hidden text input with a rotating per-request name (salt + time hash). Blind automation that fills every form field trips the trap and is rejected server-side before any token is verified.
- Submit-timing signal. The page records load time and reports the submit delta; sub-300ms submissions (without human interaction time) are rejected. Disabled in Silent Auto-Verify mode, where legitimate browsers submit immediately.
- Challenge token layer. Every CAPTCHA mode uses a signed challenge nonce + answer hash; any wrong, stale, or forged token fails verification regardless of the honeypots above.
The server-side honeypot validation runs in both protection modes (FULL and FRONTEND) and on both verification endpoints (AJAX verification and the /bbcs-verify/ endpoint), before any cookie or token is issued.
Can I block AI crawlers (ChatGPT, Claude, Perplexity)?
Yes. GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, Claude-SearchBot, and PerplexityBot are verified via 1,435 CIDR ranges synced from the cloud API. You can allow or block each provider independently. Bytespider (ByteDance) is verified via PTR (.bytedance.com). Trusted AI crawlers pass; impersonators are blocked.
Can I get Telegram notifications?
Yes. Free. Connect a Telegram bot via @BotFather, then open Add-ons → Telegram Notifications and enter the Bot Token and Chat ID. You’ll receive weekly security summaries: total requests, allowed, blocked, suspicious, search bots, fake bots, plus timezone, protection mode, security score, and block rate. A connection test button verifies setup instantly.
Can I display security stats on the frontend of my site?
Yes. Shortcodes let you embed counters, charts, health gauges, top IPs/countries, system status, and more on any page. Perfect for client dashboards, status pages, and public security transparency reports.
What is the Health Score?
A 44-parameter security assessment displayed as a visual gauge (0-100). Five levels: Critical (<25), Weak (25-49), Moderate (50-69), Strong (70-84), Secure (≥85). Three categories weighted: core protection (75%), cloud extended (25%), neutral indicators. The score updates in real-time as you change settings – a built-in guide to improving your site’s security posture.
Does the PRO version include a trial?
No traditional trial. Instead, the free version includes the full firewall, all CAPTCHA modes, anti-detect scoring, rate limiting, FCrDNS verification, 2FA, Multisite, Redis/Memcached, Telegram alerts, shortcodes, and live traffic monitoring – enough to protect most sites permanently. A limited-time Premium promo (14 days, no credit card) is available inside the plugin to try cloud features. PRO plans start at $12/month with a 30-day refund policy.
What happens when I delete the plugin?
Clean uninstall: all database tables are dropped, WordPress options deleted, transients cleared, cron hooks removed, MU-plugin files cleaned, and the uploads/botblocker/ directory deleted. On multisite, per-site cleanup runs in batches of 50. Uninstall feedback dialog collects your reason for leaving. Zero leftover data – no orphaned rows, no stale cron jobs.
Is my visitors’ data collected or stored?
No. BotBlocker Security does not collect or process personal data of your visitors. All cloud analysis is performed on technical parameters only (IP, headers, User-Agent). No personally identifiable information is collected, stored, or transmitted to any external service.
Where can I find documentation and support?
Product site: https://botblocker.top/products/ Pricing and PRO plans: https://botblocker.top/pricing/ Documentation: https://docs.botblocker.top/#/en/README Contact/support: https://botblocker.top/contacts/ Community: https://botblocker.top/community/
What license is BotBlocker Security under?
GPLv2 or later. See LICENSE.txt for details.
Who develops BotBlocker Security?
Developed and maintained by GLOBUS.studio. Concept, architecture & code – Yevhen Leonidov ( https://leonidov.dev/ ). Code, code review – Andrii Lukashevych. Code, translations – Aleksandr Kinakh.