Expanded protection for WordPress sites
BotBlocker Pro is a paid edition of BotBlocker Security for sites that need more than its core firewall and traffic-control features. It combines early request filtering with cloud threat intelligence, behavioral and heuristic detection, malware scanning, security headers, performance controls, and additional administration tools.
The underlying platform uses three interception layers: wp-config.php, the MU-plugin phase, and the main shield. This allows known threats to be blocked before WordPress, themes, or plugins load. Returning visitors can be handled through pre-generated PHP runtime files with SHA-256 integrity and without database queries. The security platform also includes bot detection, rate limiting, CAPTCHA, two-factor authentication, anti-spam controls, logging, analytics, notifications, and diagnostic tools.
Pro threat detection
Cloud Threat Intelligence cross-checks attack IP information globally and adds reputation checks for VPNs, Tor, proxies, autonomous systems, and hosting providers. Behavioral and heuristic detection is intended to identify unfamiliar attack patterns before they appear in signature lists.
Early Init Mode filters traffic before WordPress Core loads through wp-config.php boot code. The source describes this mode as multisite-aware and notes that it can save processing time and memory on blocked requests. Self-healing runtime files are also included in the Pro additions.
BotBlocker’s detection system combines User-Agent signatures, additional bot signatures, header checks, and anti-detect scoring. These checks can identify browser automation and headless tools even when User-Agent strings are altered. CAPTCHA protection includes nine modes, including Silent Auto-Verify, which is designed to reduce interaction for human visitors.
Malware and configuration controls
Malware scanning
The malware scanner checks files using more than 25 detection patterns, including eval() chains, base64 obfuscation, injected scripts, and webshell markers. A deobfuscation preprocessor supports the scanning process across core, plugin, and theme files. File integrity verification compares WordPress core, plugin, and theme files with known-good references and can identify modified, added, or missing files. Per-file and wildcard ignores, along with scheduled background scanning, are available.
Headers, login, and XML-RPC
Security Headers can deploy through an MU-plugin before other plugins load. Supported controls include HSTS, CSP with custom domain whitelisting, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy. The plugin can also hide the login URL with a custom administrator slug and define what happens at the default login address, including a 403, 404, home redirect, or custom redirect.
XMLRPC Tunnel provides an allowlisted XML-RPC path with IPv4, IPv6, CIDR, and wildcard entry formats. Multi-header real-IP resolution and automatic blocking of non-allowlisted access are included.
Performance and setup
Speed Up WordPress provides 14 listed frontend and server optimizations, including controls for emojis, jQuery Migrate, dashicons, global styles, embeds, RSS feeds, XML-RPC, the WordPress version, shortlinks, and self-pingbacks.
To set up BotBlocker Pro, configure the firewall and CAPTCHA controls first, then review cloud intelligence, early initialization, login URL, security header, scanner, integrity, and XML-RPC settings according to the site’s needs. Use the available analytics, logs, diagnostics, and management tools to review blocked traffic and configuration changes.
