by Yevhen Leonidov 5 (10 reviews)

BotBlocker Security – Complete security platform

Name: BotBlocker Security – Complete security platform
Rating: 5.0 (10 reviews)
Author: Yevhen Leonidov

Complete security platform for everyday: block bots, brute-force, viruses, spam, fake crawlers. WAF, 2FA, no-malware, proactive defense.

BotBlocker Security ranks #3,680 among WordPress.org plugins with 3,000+ active installations, is #307 of 5,058 in the Security category, a 5/5 rating from 10 reviews, and was last updated Oct 11, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.7.6 Current Version v1.7.6

Updated 3 weeks ago Last Update on 11 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#307 of 5,058 in Security Top 5% by installs Downloads +208.9% this week Actively maintained

View on WordPress.org

Rank

#3,680

— No change

Active Installs

3K+

— No change

KW Avg Position

— No change

Downloads

14.4K

+197 today

Support Resolved

100%

— No change

Rating

100%

Review 5 out of 5

5 (10 reviews)

Next Milestone 4K

Total Progress 97.1%

3K+ 4K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 29 more installs to reach 4K+

Rank Changes

Current #3,680

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

10 reviews

Overall 100%

10 (100%)

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

No known vulnerabilities on record for BotBlocker Security. Checked 3 months ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.7.6
Last Updated: Oct 11, 2026
Requires WP: 5.9+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: Yevhen Leonidov

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 10
Support Threads: 2
Resolved: 100%

Keywords

anti-spam Brute Force captcha firewall security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners who need protection against automated threats without relying on paid third-party security services. It blocks brute force attacks, spam, fake crawlers, and other bot traffic before WordPress loads, reducing server load and false crawler impersonation.

Three-layer firewall architecture
9 CAPTCHA modes
Two-factor authentication (2FA)
FCrDNS fake crawler detection
Brute force protection with lockouts
XML-RPC and REST API lockdown
LLM/AI crawler management
Payment gateway webhook bypass

Frequently Asked Questions

Common questions about BotBlocker Security – Complete security platform

Yes. The free version includes: three-layer firewall, all CAPTCHA modes, anti-detect scoring, FCrDNS bot verification, rate limiting, 2FA with backup codes, anti-spam, brute-force protection, XML-RPC and REST API protection, live traffic monitor, Telegram alerts, shortcodes, diagnostic tools, command palette, Redis/Memcached, Multisite support, and DDoS compatibility. PRO adds cloud threat intelligence, Early Init Mode, premium addons (Hide Login, Security Headers, Speed Up, Malware Scanner, Behavioral Analysis, and more), and priority support. Premium starts at $12/month.

No. Measured overhead is +3-15ms for verified visitors with zero database queries - all rules load from pre-generated PHP files with SHA-256 integrity. Under attack, server load typically drops because bad requests are rejected at the earliest interception layer, before WordPress, PHP, or database code runs. FULL mode saves 30-100ms and 5-20MB RAM per blocked request.

Yes. BotBlocker reads proxy headers (CF-Connecting-IP, X-Forwarded-For, X-Real-IP) to find the real client IP and blocks attempts to bypass Cloudflare by hitting your origin directly. Fully compatible with Cloudflare, Sucuri, Incapsula, AWS CloudFront, Fastly, KeyCDN, and StackPath. Cloudflare Business+ users can also enable TLS fingerprinting (JA3/JA4) for bot detection - see docs/TLS-FINGERPRINTING.md.

Yes. Auto-detection for e-commerce platforms and payment providers. Stripe, PayPal, Mollie, Adyen, Razorpay, YooKassa, and other webhooks are automatically recognized and never blocked. Detection layers (path patterns, query keys, action names, signature headers) ensure zero interference with payment processing. Bypass modes (full/partial), settings and hardening recommendations: see docs/PAYMENT-BYPASS.md.

Yes. BotBlocker automatically sets DONOTCACHEPAGE and multiple cache-bypass headers (Cache-Control: no-store, X-LiteSpeed-Cache-Control, X-Accel-Expires, CDN-Cache-Control, Surrogate-Control) on verification pages so PHP-based caches, Nginx reverse proxies, CDN edges, and surrogate caches never store security barriers. Works out of the box with WP Super Cache (PHP mode), W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, WP Fastest Cache, Cache Enabler, and Swift Performance. Server-level caches (Nginx FastCGI, Varnish) need a cookie-based bypass rule - see docs/CACHE-COMPATIBILITY.md.

Yes. Since version 1.6.13, BotBlocker auto-detects JS-challenges from external DDoS protection services. HMAC-signed AJAX responses let the plugin distinguish its own responses from DDoS-provider challenge pages. Circuit Breaker prevents retry storms (3 failures → 30-second cooldown). BotBlocker is the only WordPress security plugin that works correctly behind aggressive DDoS protection without manual whitelisting. See docs/DDOS-COMPATIBILITY.md.

No. BotBlocker auto-detects your server IP during setup and lets you allowlist admin IPs and trusted services. WP-Cron and internal WordPress calls always pass. If you ever get locked out, a hashed Secret URL (generated in the admin panel and sent to the admin email) provides emergency access - no FTP required.

No. Only technical request parameters (IP, headers, User-Agent) are analyzed locally on your server. No PII is stored or sent anywhere. GDPR-compliant under Legitimate Interest (Art. 6(1)(f)). CCPA compliant - no PII collection, no data sale. Full details in docs/PRIVACY.md.

Yes. Every feature works with IPv4, IPv6, or dual-stack setups. Separate database tables and logic for each protocol family.

Yes, since version 1.6.15. Network activation, per-site data isolation, per-site settings, and per-site cleanup on uninstall. Free on all plans.