Protect WordPress with BotBlocker Pro

Filter traffic at various stages

BotBlocker Pro is the paid edition of BotBlocker Security, extending its firewall and traffic controls with cloud threat intelligence, Early Init Mode, behavioral detection, malware scanning, security headers, and performance settings. The platform intercepts requests through three layers: wp-config.php, the MU-add-on phase, and the main shield. Known threats can be blocked before WordPress, themes, or plugins load.

For returning users, pre-generated PHP runtime documents use SHA-256 integrity checks and load without database queries. Core tools include bot detection, rate limiting, CAPTCHA, two-factor authentication, anti-spam controls, logging, analytics, notifications, and diagnostics.

Compare reputation and behavior signals

Cloud Threat Intelligence cross-checks attack IP information globally and includes reputation checks for VPNs, Tor, proxies, autonomous systems, and hosting providers. Behavioral and heuristic detection looks for unfamiliar attack patterns before they appear in signature lists.

Early Init Mode runs boot code through wp-config.php to filter traffic before WordPress Core loads. It is multisite-aware and can reduce processing time and memory on blocked requests. The mode auto-disables if the Cloud API is inactive, and Pro includes self-healing runtime files.

Bot detection combines User-Agent signatures, additional bot signatures, header checks, and anti-detect scoring. These checks can identify browser automation and headless tools even when User-Agent strings are altered. CAPTCHA protection has nine modes, including Silent Auto-Verify, which is designed to reduce interaction for human visitors.

Scan files and verify changes

The malware scanner checks for more than 25 patterns, including eval() chains, base64 obfuscation, injected scripts, and webshell markers. A deobfuscation preprocessor supports scanning WordPress core, add-on, and theme files. The scanner can also cover uploads, custom paths, and database content, with scheduled background scans available.

File integrity verification compares WordPress core, plugin, and theme files with known-good references to identify modified, added, or missing files. Per-file and wildcard ignores let you exclude selected paths.

Set access and configuration controls

Security Headers can deploy through an MU-plugin before other plugins load. Supported controls include HSTS, CSP with custom domain whitelisting, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy.

Hide Login URL lets you set a custom administrator slug and pick what happens at the default login address: return a 403 or 404, redirect home, or use a custom redirect. XMLRPC Tunnel provides an allowlisted XML-RPC path with IPv4, IPv6, CIDR, and wildcard entry formats. It supports multi-header real-IP resolution and can block access that is not allowlisted.

Choose performance and administration tools

Speed Up WordPress lists 14 frontend and server optimizations, including controls for emojis, jQuery Migrate, dashicons, global styles, embeds, RSS feeds, XML-RPC, the WordPress version, shortlinks, and self-pingbacks. Other Pro tools include HTTP-to-HTTPS redirects, mixed-content fixes through output buffering, a customizable first-party cookie banner, and cron job management for monitoring and debugging. Priority support has a 24-hour response time.

For setup, configure the firewall and CAPTCHA controls first. Then review cloud intelligence, early initialization, login URL, security header, scanner, integrity, and XML-RPC settings according to the website's needs. Use analytics, logs, diagnostics, and management tools to review blocked traffic and configuration changes.