CB Bot Guard

Description

Bad bots don’t just spam forms. They hammer search pages, product filters and add-to-cart links, and every one of those requests makes WordPress and WooCommerce build a full page. On shared hosting and small VPS plans, that is what pushes memory over the limit and takes the site down.

CB Bot Guard spots these clients and answers them with a tiny 403 or 429 response, before your theme and plugins do any work. Real visitors are not affected.

What it detects

• Request floods. Too many requests per minute from one IP.
• Heavy-page floods. Searches, product filter and sort combinations, add-to-cart, checkout, login and comment posts have their own, lower limit. These are the usual cause of RAM spikes on WooCommerce stores.
• Scraping tools and attack scanners by user agent (python-requests, curl, sqlmap, WPScan and more), plus requests with no user agent.
• Aggressive SEO crawlers that never send you visitors (optional list, on by default).
• AI crawlers (optional list, off by default).
• Fake Googlebot, Bingbot, Applebot and Yandex. Anything claiming to be a search engine must pass a reverse DNS check. Genuine crawlers are remembered and never rate limited, so your SEO is safe.
• Vulnerability probes for files like .env, .git, phpMyAdmin, Adminer and common web shells.
• XML-RPC abuse, failed logins and 404 floods.
• Spam forms. A hidden honeypot field on comment and registration forms (WordPress and WooCommerce). Comments that your anti-spam plugin marks as spam also count against the sender.

Each event adds points to the IP. When it reaches the threshold (10 by default) the IP is blocked for 24 hours. Repeat offenders are blocked for 7 days, then permanently. Every number is adjustable.

Built to save resources

• Early blocking (one click). An optional must-use loader runs the blocklist check before other plugins load. In testing, a blocked request used about 3 MB of memory instead of a full page load, with no measurable cost for real visitors.
• Server-level blocking (optional, Apache). Blocked IPs can be written into .htaccess so they never start PHP at all. You can preview the rules first, and a backup is saved before every change.
• No database queries for normal visitors. Only suspicious or blocked traffic is logged. Counts for blocked requests are buffered and saved every 5 minutes.
• Uses APCu for counters when available, otherwise small files.

Dashboard

• Live stats and 24-hour charts of stopped requests and suspicious events.
• IP Manager: block, unblock or always-allow single IPs, CIDR ranges (1.2.3.0/24) and wildcards (1.2.3.*). Bulk actions, search, sorting and a detail page for every IP.
• Activity log with filters.
• Import and CSV export.
• Settings for every limit, list and pattern.

Safe by default

• Your own IP is added to the allow list on activation, and the dashboard will not let you block an IP or range that contains your own address.
• Your server’s own IP (WP-Cron, health checks) is never blocked.
• Logged-in users are never rate limited.
• Payment gateway callbacks (wc-api, Stripe, PayPal and WooCommerce REST) skip the bot checks, so orders are never lost. Add any other callback URL in Settings.
• Cloudflare support reads the real visitor IP only from genuine Cloudflare servers, so the header cannot be spoofed.
• An emergency off switch: define( 'CBBG_DISABLE', true ); in wp-config.php.

CB Bot Guard Pro

Everything described above is free. A separate Pro add-on is planned for agencies and busy stores. It will add country and network blocking, attack alerts, a shared blocklist across sites, Cloudflare firewall sync, IP reputation checks and weekly reports.

External services

CB Bot Guard does not send data to any third-party service, and it does not phone home.

• Search engine verification. When a request claims to come from Googlebot, Bingbot, Applebot or Yandex, the plugin performs a reverse and forward DNS lookup of that request’s IP address using your server’s own DNS resolver. The result is cached for a day. No other data is sent.
• Lookup links. The IP detail page shows links to AbuseIPDB (terms, privacy) and ipinfo.io (terms, privacy). Nothing is sent unless an administrator clicks one of these links, which opens the site in a new tab.

Privacy

The plugin stores, in your own database, the IP address, user agent and requested URL of requests that trigger a rule (for example a flood or a probe). Normal visitors are not logged. Entries are deleted automatically after 14 days (adjustable). Mention this in your privacy policy if your jurisdiction requires it.