DevDome Bot Protection is a bot blocker that detects scanners, exploit probes and unwanted automated traffic. Review bot traffic and block bad bots with configurable detection rules, request rate limits and custom rules, without CAPTCHAs. Use Known Bots for crawler control, with separate choices for
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.2 and PHP 7.4.
SourceWordPress plugins · Nov 14, 2026
01 / Source details
Aboutthistool.
DevDome Bot Protection is a bot blocker that detects scanners, exploit probes and unwanted automated traffic. Review bot traffic and block bad bots with configurable detection rules, request rate limits and custom rules, without CAPTCHAs.
Use Known Bots for crawler control, with separate choices for supported AI training, search and user-request agents. Block AI crawlers through WordPress’s virtual robots.txt and HTTP blocking in Block Bad Bots mode. Google-Extended and Applebot-Extended use robots.txt controls only.
Start in Record Bots to review detected requests before enabling HTTP blocking. Local protection needs no account. Detection uses local rules, with reference lists downloaded when Outside Lookups is enabled. Known Bots robots.txt directives, the enabled honeypot and browser session collection operate independently of the protection mode.
Three modes
Turned Off: disables the main protection engine.
Record Bots: records detected bots without enforcing HTTP block actions.
Block Bad Bots: blocks requests that match your blocking rules.
Known Bots robots.txt directives, the enabled honeypot and browser session collection operate independently of these modes.
Five tabs
Overview: choose your mode, review traffic totals and check sample crawler access. Mode changes save on click.
Activity: review caught requests, bot and people totals, recent events, countries and technical details. Add an Allow This Visitor exception when IP anonymization is off.
Rules: set actions for built-in detection, rate limits, repeat offenders, automated browsers, the honeypot and Bot Radar. Add custom rules for user agents, paths, IP addresses, ranges, countries or network numbers. Action changes save on click.
Known Bots: control AI crawlers, search engines, SEO crawlers, social previews and uptime monitors. Each switch saves immediately. OpenAI and Anthropic training, search and user-request agents have separate controls.
Settings: manage privacy, time zone, trusted proxies, feeds, account connection, import/export, Clear Statistics and Cloudflare rules.
Use Recommended on Rules and Known Bots asks for confirmation. On Rules, it restores recommended actions while preserving thresholds and feature switches.
Caught By Your Rules includes requests that would be blocked in Record Bots. Traffic totals count requests, not unique people.
Detection and crawler controls
Built-in rules cover scanner paths, scanner tools, Spamhaus DROP addresses, datacenter networks, empty user agents and automation tools.
Additional controls cover login, XML-RPC and REST request rates, rapid page requests, repeat offenders and automated browser sessions. A first-party browser beacon records interaction signals. A hidden honeypot link helps identify crawling networks after multiple distinct IPs reach it. You can unflag networks or exempt them from future honeypot flagging.
In the full engine, verified crawlers are exempt from automatic detection rules. Verification uses downloaded IP ranges or cached forward-confirmed reverse DNS. An explicit Known Bots block overrides that exemption. Custom Allow rules take precedence over the full engine’s blocking rules.
Blocked crawlers receive directives in WordPress’s virtual robots.txt and HTTP blocking in Block Bad Bots mode. Google-Extended and Applebot-Extended are robots.txt controls only. Physical robots.txt files are not edited; Known Bots provides a downloadable snippet.
Failed feed downloads keep previous lists. Unreadable event lists and counts are marked unavailable, with messages such as “could not be read” or unknown-value indicators instead of zero. Database failures also produce an error banner.
Import/export transfers supported settings, Known Bots choices and custom rules as JSON. Import applies supplied settings and adds missing custom rules. Statistics, downloaded feeds and connection secrets are not transferred.
Optional DevDome account
Local protection works without an account. Connect through Settings or the shared DevDome hub to see this site’s bot activity and settings in the DevDome dashboard. Settings are changed only in this plugin, by an administrator of the site; the dashboard cannot change them.
Connected sites also send built-in rule actions, supported custom rules, time zone and daily traffic totals. External services below explains the exchange.
Privacy and data storage
The plugin stores data in your site’s database:
Bot events, including time, IP address, requested path without query strings, user agent, classification, action, reason and available Cloudflare signals.
Browser sessions with a random identifier, IP address, hashed user agent, timestamps, page counts and interaction flags.
Per-IP reputation with request counts, blocking decisions, timestamps and available country or network information.
Daily and hourly totals without IP addresses.
Settings, custom rules, learned offender lists and cached reference data.
The browser beacon uses the first-party ddc_sid session cookie. It sends interaction flags to your own site, not form contents.
Anonymize IPs shortens addresses stored in new events and sessions to an IPv4 /24 or IPv6 /48 prefix. Reputation and enforcement records can still contain full addresses. This setting does not disable external ASN lookups or Bot Radar reporting.
Events, sessions and reputation records are kept for 90 days on every site. Daily totals remain for 3 years; hourly totals are pruned after about 2 days. Retention is not configurable.
The WordPress personal data exporter finds matching events using comment IP addresses associated with the requested email address or user. The eraser also removes matching sessions and reputation rows and updates offender lists. Only exact addresses are matched: rows shortened by Anonymize IPs cover several visitors and are neither exported nor erased. Without matching comment addresses, these tools cannot identify the person’s records. Suggested privacy-policy text is provided.
Clear Statistics in Settings requires typing CLEAR. It permanently removes events, sessions, learned offender history, lifetime counters and daily and hourly totals. Settings, custom rules, Known Bots choices and the account connection remain. Connected sites also request clearing the dashboard’s daily totals, retrying until acknowledged.
Deleting the plugin removes its local tables, settings, schedules and caches. Shared library data is removed when the last installed plugin using that library is deleted.
External services
The feed and lookup services below are not contacted until Outside Lookups is turned on in Settings (off by default). The optional account connection and Bot Radar have their own consent switches, and an error report is sent only when you press its button. Scheduled requests use WordPress cron. With Outside Lookups on, reference feeds refresh daily; Settings also provides Refresh Now. Providers receive normal connection metadata, including the requesting server’s IP address.
api.devdome.com: reference feeds
No account is required. Feed refreshes download:
https://api.devdome.com/bot-protection/list for bot user-agent patterns.
https://api.devdome.com/bot-protection/asns for datacenter network numbers.
https://api.devdome.com/bot-protection/drop for Spamhaus DROP ranges.
These lists support local detection. GET requests send a DevDome-Bot-Protection/version user agent, without a site or visitor payload.
Feed refreshes download https://developers.google.com/static/search/apis/ipranges/googlebot.json and https://developers.google.com/static/search/apis/ipranges/special-crawlers.json to verify crawler addresses. GET requests send a DevDome-Bot-Protection/version user agent, without a site or visitor payload.
Feed refreshes download https://www.bing.com/toolbox/bingbot.json to verify Bingbot addresses. GET requests send a DevDome-Bot-Protection/version user agent, without a site or visitor payload.
Feed refreshes download https://search.developer.apple.com/applebot.json to verify Applebot addresses. GET requests send a DevDome-Bot-Protection/version user agent, without a site or visitor payload.
Feed refreshes download https://openai.com/gptbot.json, https://openai.com/searchbot.json and https://openai.com/chatgpt-user.json to verify OpenAI crawler addresses. GET requests send a DevDome-Bot-Protection/version user agent, without a site or visitor payload.
After you press Connect, the shared library contacts https://analytics.devdome.com/api/plugin/connect/start and https://analytics.devdome.com/api/plugin/connect/claim.
The handshake sends the site domain and identifier, site token, admin return URL and temporary credentials to link your account. The site also exposes a one-way token hash for connection verification.
After Connect starts the handshake, your browser opens https://devdome.com/connect/ with a temporary request token so you can author
See it in action
Screenshots & previews.
Overview: choose Block Bad Bots, Record Bots or Turned Off, with the visits from bots and from people for the period.Activity: visits from bots and from people over the last 7 days.Rules: the built-in detection rules, each set to Allow, Log or Block.Known Bots: AI crawlers with a Blocked or Allowed switch per agent, training, search and user requests kept separate.Settings: the optional account connection, the threat feeds and the privacy settings.
02 / Source details
Gettingstarted.
01Install and activate DevDome Bot Protection.
02Open DevDome, then Bot Protection.
03Review Activity while the plugin is in Record Bots.
04Adjust Rules and Known Bots.
05Select Block Bad Bots on Overview when ready.
03 / Source details
Frequently asked questions.
Does this require an account?
No. Local detection, rules, Known Bots controls and reference feeds work without an account. Connecting adds dashboard access and synchronization.
Does it protect cached pages?
PHP protection runs when requests reach WordPress. Pages served entirely from a CDN or server cache can bypass it.
Settings generates two copy-paste Cloudflare rules locally: scanner and exploit paths, and optional XML-RPC blocking. Both exempt Cloudflare-verified crawlers. You deploy them yourself; the plugin makes no Cloudflare API call.
Can I control AI training separately from search?
Yes. Known Bots separates supported training, search and user-request agents. Review each bot’s description before changing its action.
Will crawler access checks guarantee search rankings?
No. Crawler Access evaluates sample requests. It checks access, not rankings.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
