DevDome Bot Protection detects scanners, exploit probes and unwanted automated traffic. Start in Record Bots to see what your rules catch, adjust crawler access and turn on blocking when ready. Local protection works without a DevDome account or CAPTCHAs.
Free and GPL licensed, reviewed by the WordPress.org plugin team.
Review caught requests, choose how detection rules respond and set access for known crawlers. Overview, Activity, Rules, Known Bots and Settings keep the controls in five tabs.
Choose Turned Off, Record Bots or Block Bad Bots. Record Bots logs detected bots without enforcing HTTP blocks, so you can review caught requests first. Known Bots robots.txt directives, the enabled honeypot and browser session collection work independently of these modes.
Built-in rules cover scanner paths, scanner tools, Spamhaus DROP addresses, datacenter networks, empty user agents and automation tools. Choose actions on Rules, where action changes save on click. Failed reference feed downloads keep the previous lists.
Known Bots gives OpenAI and Anthropic training, search and user-request agents separate controls. Each switch saves immediately. Google-Extended and Applebot-Extended are robots.txt controls only. For a physical robots.txt file, download the supplied snippet and add it yourself.
Set controls for login, XML-RPC and REST request rates, rapid page requests, repeat offenders and automated browser sessions. A first-party browser beacon records interaction signals on your own site without collecting form contents.
A hidden honeypot link helps identify crawling networks after multiple distinct IPs reach it. Unflag networks or exempt them from future honeypot flagging. Optional Bot Radar shares detection signals and receives a community list; it is off by default.
Add custom rules for user agents, paths, IP addresses, ranges, countries or network numbers. Custom Allow rules take precedence over full-engine blocking. Verified crawlers are exempt from automatic detection in the full engine unless explicitly blocked in Known Bots.
Review caught requests, bot and people totals, countries and technical details in Activity. Totals count requests, not unique people. Connect an optional DevDome account to view activity and settings in the dashboard. The dashboard cannot change settings on your site.
Export supported settings, Known Bots choices and custom rules as JSON. On WordPress 6.9 or newer, 10 abilities let authorised agents read status, manage settings and rules, review events, pause or resume protection and clear statistics.
Install the plugin, review what Record Bots catches, then choose your rules and turn on blocking.
Install DevDome Bot Protection from WordPress.org and activate it. Open DevDome > Bot Protection and review Activity while the plugin is in Record Bots. No DevDome account is needed.
Adjust detection actions on Rules and crawler choices on Known Bots. Review the separate AI training, search and user-request controls. Mode changes, rule actions and Known Bots switches save on click.
Check the requests shown under Caught By Your Rules, including those that would be blocked in Record Bots. When the rules look right, select Block Bad Bots on Overview to enforce HTTP blocking.
No. Local detection, rules, Known Bots controls and reference feeds work without a DevDome account. Connecting is optional and adds dashboard access and synchronization. Settings go from your site to the dashboard only. The dashboard cannot change them; a site administrator changes settings in the plugin.
Turned Off disables the main protection engine. Record Bots records detected bots without enforcing HTTP block actions. Block Bad Bots blocks requests that match your blocking rules. Known Bots robots.txt directives, the enabled honeypot and browser session collection operate independently, so Turned Off does not disable those features.
Yes. Known Bots separates OpenAI and Anthropic training, search and user-request agents. Blocked crawlers receive virtual robots.txt directives and HTTP blocking in Block Bad Bots. Google-Extended and Applebot-Extended are robots.txt controls only. Physical robots.txt files are not edited; download the supplied snippet if your site uses one.
In the full engine, verified crawlers are exempt from automatic detection rules. Verification uses downloaded IP ranges or cached forward-confirmed reverse DNS. An explicit Known Bots block overrides that exemption. Crawler Access checks sample requests to help you review access; it does not check or guarantee search rankings.
PHP protection runs only when requests reach WordPress. Pages served entirely from a CDN or server cache can bypass it. Settings generates two copy-paste Cloudflare rules locally: scanner and exploit paths, and optional XML-RPC blocking. Both exempt Cloudflare-verified crawlers. You deploy them yourself; the plugin makes no Cloudflare API call.
No. Nothing is contacted on activation. Outside Lookups is off by default and controls reference feed downloads and country and network lookups. The good-bot check still uses your server's own DNS resolver. Account connection and Bot Radar have separate consent switches, and an error report is sent only when you press its button.
Traffic totals count requests, not unique people. Caught By Your Rules includes requests that would be blocked in Record Bots. Activity shows recent events, countries and technical details. Unreadable event lists and counts are marked unavailable rather than shown as zero, and database failures display an error banner.
Import/export transfers supported settings, Known Bots choices and custom rules as JSON. Import applies the supplied settings and adds missing custom rules. Statistics, downloaded reference feeds and account connection secrets are not transferred, so those are not included in a settings export.
Installation, settings, data use and troubleshooting, before you install.
Install and activate DevDome Bot Protection from WordPress.org. Version 1.0.4 requires WordPress 6.2 or newer and PHP 7.4 or newer.
No DevDome account is needed for local protection. Connecting through Settings or the shared DevDome hub is optional. The dashboard can show activity and settings but cannot change settings on your site.
Open DevDome > Bot Protection. Review Activity while the plugin is in Record Bots, which records detected bots without enforcing HTTP blocks. Caught By Your Rules includes requests that would be blocked. Traffic totals count requests, not unique people.
Adjust Rules and Known Bots, including the separate OpenAI and Anthropic training, search and user-request controls. Google-Extended and Applebot-Extended are robots.txt controls only. Use Recommended asks for confirmation; on Rules it preserves thresholds and feature switches.
Select Block Bad Bots on Overview when ready. Mode changes, rule actions and Known Bots switches save on click. Turned Off disables the main engine, but Known Bots robots.txt directives, the enabled honeypot and browser session collection operate independently.
Nothing is contacted on activation. Outside Lookups is off by default; enabling it downloads reference feeds and permits country and network lookups that send public IP addresses to DevDome. Good-bot checks still use your server's DNS resolver. Account connection and Bot Radar have separate consent switches. Connected sites send settings, supported custom rules including IP rule addresses, and daily totals. The reference feeds come from DevDome, Google, Bing, Apple and OpenAI; those downloads carry only the plugin version in the user agent, no site or visitor data. Bot Radar, when you turn it on, sends a daily report with a random site ID, repeat-offender public IP addresses and flagged network numbers. Connecting an account sends the site domain and identifier, site token and temporary credentials; connecting through the inventory form also shares active DevDome plugin names and versions plus library, WordPress and PHP versions. Lists of more than 200 custom rules stay local and are not synced. Report this error, only when you press it, sends redacted error text, plugin, library, WordPress and PHP versions, multisite status, locale, the screen, diagnostic excerpts, the site domain and ID, any account ID and your site administrator email.
Your database stores bot events, browser sessions, reputation records, totals, settings and reference data. Events, sessions and reputation records have fixed 90 day retention; daily totals remain for 3 years and hourly totals for about 2 days. The first-party ddc_sid session cookie supports interaction signals sent to your own site, not form contents. Anonymize IPs shortens new event and session addresses to IPv4 /24 or IPv6 /48 prefixes; enforcement records can retain full addresses, and external lookups and Bot Radar reporting remain possible.
The WordPress personal data exporter finds events through exact comment IP addresses associated with the requested email address or user. The eraser also removes matching sessions and reputation records and updates offender lists. Neither includes shortened addresses, and without matching comment addresses they cannot identify a person's records. Suggested privacy-policy text is provided. Clear Statistics requires typing CLEAR and permanently removes recorded activity and totals while keeping settings, rules, Known Bots choices and the account connection.
Updates for the WordPress.org edition come only from WordPress.org, like any other directory plugin. This edition contains no self-hosted updater.
Deleting the plugin removes its local tables, settings, schedules and caches. Shared library data is removed when the last installed plugin using that library is deleted. To clear recorded activity while keeping your configuration, use Clear Statistics in Settings instead.
Caught requests are not blocked: check the mode on Overview. Record Bots records detections without enforcing HTTP blocks, and Turned Off disables the main engine. Select Block Bad Bots to enforce your blocking rules. Custom Allow rules take precedence over full-engine blocking.
Reference lists or country details are missing: Outside Lookups is off by default. Enable it in Settings if you want feed downloads and country and network lookups, then use Refresh Now. Failed downloads keep existing lists. Unreadable counts appear unavailable, and database failures show an error banner.
Blocked visitors still see cached pages: pages served entirely by a cache or CDN can bypass PHP protection. Settings provides two copy-paste Cloudflare rules for scanner and exploit paths and optional XML-RPC blocking. Deploy them yourself; both exempt Cloudflare-verified crawlers.
Crawler choices are missing from robots.txt: the plugin adds directives to WordPress's virtual robots.txt but does not edit a physical file. Download the snippet from Known Bots for a physical file. Google-Extended and Applebot-Extended controls apply only through robots.txt.
Still stuck? Ask on the WordPress.org support forum or use the DevDome contact form. For a security problem, use the Report a security issue tab instead.
Read from the WordPress.org release when this site was last synced. The two latest versions are shown here; the full history is on WordPress.org.
Please tell us before telling anyone else, and we will fix it and credit you if you want the credit. Use the contact form and say it is a security report, so it gets read first.
We are a small team, so we will not pretend to a 24/7 security desk or a guaranteed response time. We will read it, reply, and tell you honestly what we are doing about it.
Install DevDome Bot Protection from WordPress.org, activate it and open DevDome > Bot Protection to review traffic in Record Bots before turning on blocking.
