by WebDecoy 1 (0 reviews)

WebDecoy Bot Detection - Block AI Crawlers, Spam Bots & Card Testing

Name: WebDecoy Bot Detection - Block AI Crawlers, Spam Bots & Card Testing
Author: WebDecoy

Stop card testing, fake orders, comment spam, and AI crawlers with no CAPTCHA. 100% local, no account or API key, works instantly on activation.

WebDecoy Bot Detection ranks #55,370 among WordPress.org plugins with 1+ active installations, is #6,748 of 12,463 in the E-commerce category, a 1/5 rating from 0 reviews, and was last updated Sep 21, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v2.8.3 Current Version v2.8.3

Updated 1 day ago Last Update on 21 Sep, 2026

Refreshed 11 hours ago Last Refreshed on

#6,748 of 12,463 in E-commerce Downloads +71.6% this week

View on WordPress.org

Rank

#55,370

— No change

Active Installs

-50%

KW Avg Position

N/A

— No change

Downloads

653

+35 today

Support Resolved

— No change

Rating

20%

Review 1 out of 5

1 (0 reviews)

Next Milestone 10

Total Progress 30%

0+ 10+

42,433

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 7 more installs to reach 10+

Rank Changes

Current #55,370

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

1.0

0 reviews

Overall 20%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.8.3
Last Updated: Sep 21, 2026
Requires WP: 6.1+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: WebDecoy

Support & Rating

Rating: ★ ☆ ☆ ☆ ☆ 1
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

ai bots bot detection security spam protection woocommerce

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,760

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

MonsterInsights - Google Analytics Dashboard for WordPress (Website Stats Made Easy)

Google for WooCommerce

800K+ installs

#75

WooPayments: Integrated WooCommerce Payments

800K+ installs

#76

WooCommerce PayPal Payments

800K+ installs

#81

WooCommerce Stripe Payment Gateway

700K+ installs

#85

WooCommerce Tax (formerly WooCommerce Shipping & Tax)

500K+ installs

#115

View all Ecommerce plugins

Frequently Asked Questions

Common questions about WebDecoy Bot Detection - Block AI Crawlers, Spam Bots & Card Testing

A team of security engineers who do bot detection full time, across more than WordPress. The detection engine in this plugin is the same one that runs in our Node.js SDK, our Cloudflare edge validator, and the WebDecoy cloud platform; the WordPress rules engine is kept byte-for-byte compatible with the Node implementation by a shared test suite. The plugin is free and fully functional because detection is the half of the problem we give away: the paid product is the network response built on top of it.

For most sites, yes. WebDecoy protects comment, login, and registration forms with invisible honeypot fields, behavioral scoring, and a background proof-of-work challenge, so real visitors never solve a puzzle, pick out traffic lights, or click a checkbox. If a request looks suspicious, the challenge runs silently in the browser instead of interrupting the person. And unlike reCAPTCHA, nothing about your visitors is sent to a third party.

Yes. Comment, login, and registration forms get invisible honeypot fields and behavioral scoring out of the box, all on by default. The plugin starts in monitor mode, recording what it would have done; switch blocking on and spam that scores above your threshold is challenged or blocked before it reaches your moderation queue.

No. WebDecoy runs entirely inside WordPress, so it protects sites on any host with no DNS changes, no proxy, and no subscription. If you were weighing WAF options, it works as a WAF alternative at the application layer, and it sees things a network WAF cannot: which form was submitted, which coupon was applied, which hidden trap was touched. It also works fine behind Cloudflare or another proxy if you already have one. On paid plans the relationship inverts: WebDecoy can push confirmed attackers to your Cloudflare or AWS WAF so they are blocked at the edge before reaching WordPress at all.

Firewalls match requests against known-bad signatures, and scanners look for infections after the fact. WebDecoy adds a third approach: deception. It plants traps (hidden paths, invisible links, decoy files, a decoy coupon) that no legitimate visitor can touch, so when a trap fires there is no doubt. It works alongside your existing firewall or scanner, and on paid plans it can push confirmed attackers to Cloudflare or AWS WAF.

No. WebDecoy works 100% locally without any API key or account. All detection, blocking, rate limiting, form protection, and WooCommerce protection works out of the box. The API key is only needed for optional cloud features like IP reputation and VPN detection.

WebDecoy Cloud adds threat intelligence feeds (AbuseIPDB, VPNAPI, MaxMind), centralized monitoring across multiple sites, indefinite detection history, automated response features like webhooks and email alerts, and WAF integrations: confirmed attackers can be pushed to Cloudflare or AWS WAF so they're blocked at the edge, before ever reaching your server. Compare plans.

No. WebDecoy adds less than 5ms of latency to requests. Server-side detection runs in milliseconds. The client-side scanner loads asynchronously with the defer attribute and doesn't block page rendering.

WebDecoy is designed to minimize false positives. You can adjust the sensitivity and blocking threshold. Start with "Log only" mode to monitor before enabling blocking. Good bots (Googlebot, Bingbot, etc.) are automatically recognized.

Yes. WebDecoy works alongside popular caching plugins. The client-side scanner runs after page load, and server-side checks happen before caching.