by
Yevhen Leonidov
5 (9 reviews)
BotBlocker Security
Stop bots, brute force, spam, and fake crawlers before they reach WordPress. Three-layer firewall, 9 CAPTCHAs, FCrDNS, 2FA. Setup in 60 seconds.
BotBlocker Security ranks #3,918 among WordPress.org plugins with 3,000+ active installations, is #299 of 4,033 in the Security category, a 5/5 rating from 9 reviews, and was last updated Jun 17, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7
v1.6.21
Current Version v1.6.21
Updated 1 month ago
Last Update on 17 Jun, 2026
Refreshed 6 hours ago
Last Refreshed on
#299 of 4,033 in Security
Top 10% by installs
Downloads +13% this week
Rank
#3,918
—
No change
Active Installs
3K+
-16.9%
KW Avg Position
23.6
—
No change
Downloads
4.3K
+18 today
Support Resolved
75%
—
No change
Rating
100%
Review 5 out of 5
5
(9 reviews)
Next Milestone 4K
3K+
4K+
242
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 100 more installs to reach 4K+
Rank Changes
Current
#3,918
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
5.0
9 reviews
Overall
100%
5
9
(100%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Tracked Keywords
Showing 5 of 5| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| firewall | 18 | — | Tag | 2 days ago |
| Brute Force | 22 | — | Tag | 2 days ago |
| anti-spam | 24 | — | Tag | 2 days ago |
| captcha | 25 | — | Tag | 2 days ago |
| security | 29 | — | Tag | 2 days ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Support Threads Overview
Resolved
Unresolved
4
Total Threads
3
Resolved
1
Unresolved
75%
Resolution Rate
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.6.21
- Last Updated
- Jun 17, 2026
- Requires WP
- 5.0+
- Tested Up To
- 7
- PHP Version
- 7.4 or higher
- Author
- Yevhen Leonidov
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 5
- Reviews
- 9
- Support Threads
- 4
- Resolved
- 75%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
7K+ installs
#2,725
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#990
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#7
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#38
Frequently Asked Questions
Common questions about BotBlocker Security - Firewall & Bot Protection
Yes. The free version includes: three-layer firewall, all 9 CAPTCHA modes, FCrDNS bot verification, 2FA with backup codes, anti-spam, brute-force protection, XML-RPC and REST API protection, live traffic monitor, Redis/Memcached, Multisite support, and DDoS compatibility. PRO adds cloud threat intelligence (5M+ attack IPs, hundreds of thousands of bot signatures), Early Init Mode, premium addons (Hide Login, Security Headers, Speed Up, Malware Scanner), and priority support. Premium starts at $12/month.
No. Measured overhead is +3-15ms for verified visitors with zero database queries - all rules load from 9 pre-generated PHP files with SHA-256 integrity. Under attack, server load typically drops because bad requests are rejected at the earliest interception layer, before WordPress, PHP, or database code runs. FULL mode saves 30-100ms and 5-20MB RAM per blocked request.
Yes. BotBlocker reads proxy headers (CF-Connecting-IP, X-Forwarded-For, X-Real-IP) to find the real client IP and blocks attempts to bypass Cloudflare by hitting your origin directly. Fully compatible with Cloudflare, Sucuri, Incapsula, AWS CloudFront, Fastly, KeyCDN, and StackPath.
Yes. Version 1.6.18 added auto-detection for 25+ e-commerce platforms and 150+ payment providers. Stripe, PayPal, Mollie, Adyen, Razorpay, YooKassa, and other webhooks are automatically recognized and never blocked. Four detection layers (paths, query keys, AJAX actions, signature headers) ensure zero interference with payment processing.
Yes. BotBlocker automatically sets DONOTCACHEPAGE and Cache-Control: no-store on verification pages so PHP-based cache plugins never cache security barriers. Works out of the box with WP Super Cache (PHP mode), W3 Total Cache, WP Rocket, LiteSpeed Cache, Hummingbird, WP Fastest Cache, and Cache Enabler. Server-level caches (Nginx FastCGI, Varnish) need a cookie-based bypass rule - see docs/CACHE-COMPATIBILITY.md.
Yes. Since version 1.6.13, BotBlocker auto-detects JS-challenges from external DDoS protection services. HMAC-signed AJAX responses let the plugin distinguish its own responses from DDoS-provider challenge pages. Circuit Breaker prevents retry storms (3 failures → 30-second cooldown). BotBlocker is the only WordPress security plugin that works correctly behind aggressive DDoS protection without manual whitelisting. See docs/DDOS-COMPATIBILITY.md.
No. BotBlocker auto-detects your server IP during setup and lets you allowlist admin IPs and trusted services. WP-Cron and internal WordPress calls always pass. If you ever get locked out, a hashed Secret URL (generated in the admin panel and sent to the admin email) provides emergency access - no FTP required.
No. Only technical request parameters (IP, headers, User-Agent) are analyzed locally on your server. Nothing personal is stored or sent anywhere. GDPR-compliant under Legitimate Interest (Art. 6(1)(f)). CCPA compliant - no PII collection, no data sale. Full details in docs/PRIVACY.md.
Yes. Every feature works with IPv4, IPv6, or dual-stack setups. Separate database tables and logic for each protocol family.
Yes, since version 1.6.15. Network activation, per-site data isolation, per-site settings, and per-site cleanup on uninstall. Free on all plans.
