Title: CB Bot Guard Author: Chris M Ybanez Published: Octubre 14, 2026 Last modified: Octubre 14, 2026 --- Search plugins ![](https://ps.w.org/cb-bot-guard/assets/banner-772x250.png?rev=3745400) ![](https://ps.w.org/cb-bot-guard/assets/icon.svg?rev=3745400) # CB Bot Guard By [Chris M Ybanez](https://profiles.wordpress.org/chrismaryey02/) [Download](https://downloads.wordpress.org/plugin/cb-bot-guard.1.0.0.zip) * [Details](https://bal.wordpress.org/plugins/cb-bot-guard/#description) * [Reviews](https://bal.wordpress.org/plugins/cb-bot-guard/#reviews) * [Installation](https://bal.wordpress.org/plugins/cb-bot-guard/#installation) * [Development](https://bal.wordpress.org/plugins/cb-bot-guard/#developers) [Support](https://wordpress.org/support/plugin/cb-bot-guard/) ## Description Bad bots don’t just spam forms. They hammer search pages, product filters and add- to-cart links, and every one of those requests makes WordPress and WooCommerce build a full page. On shared hosting and small VPS plans, that is what pushes memory over the limit and takes the site down. CB Bot Guard spots these clients and answers them with a tiny 403 or 429 response, before your theme and plugins do any work. Real visitors are not affected. #### What it detects * **Request floods.** Too many requests per minute from one IP. * **Heavy-page floods.** Searches, product filter and sort combinations, add-to- cart, checkout, login and comment posts have their own, lower limit. These are the usual cause of RAM spikes on WooCommerce stores. * **Scraping tools and attack scanners** by user agent (python-requests, curl, sqlmap, WPScan and more), plus requests with no user agent. * **Aggressive SEO crawlers** that never send you visitors (optional list, on by default). * **AI crawlers** (optional list, off by default). * **Fake Googlebot, Bingbot, Applebot and Yandex.** Anything claiming to be a search engine must pass a reverse DNS check. Genuine crawlers are remembered and never rate limited, so your SEO is safe. * **Vulnerability probes** for files like `.env`, `.git`, phpMyAdmin, Adminer and common web shells. * **XML-RPC abuse, failed logins and 404 floods.** * **Spam forms.** A hidden honeypot field on comment and registration forms (WordPress and WooCommerce). Comments that your anti-spam plugin marks as spam also count against the sender. Each event adds points to the IP. When it reaches the threshold (10 by default) the IP is blocked for 24 hours. Repeat offenders are blocked for 7 days, then permanently. Every number is adjustable. #### Built to save resources * **Early blocking (one click).** An optional must-use loader runs the blocklist check before other plugins load. In testing, a blocked request used about 3 MB of memory instead of a full page load, with no measurable cost for real visitors. * **Server-level blocking (optional, Apache).** Blocked IPs can be written into`. htaccess` so they never start PHP at all. You can preview the rules first, and a backup is saved before every change. * **No database queries for normal visitors.** Only suspicious or blocked traffic is logged. Counts for blocked requests are buffered and saved every 5 minutes. * Uses APCu for counters when available, otherwise small files. #### Dashboard * Live stats and 24-hour charts of stopped requests and suspicious events. * IP Manager: block, unblock or always-allow single IPs, CIDR ranges (`1.2.3.0/ 24`) and wildcards (`1.2.3.*`). Bulk actions, search, sorting and a detail page for every IP. * Activity log with filters. * Import and CSV export. * Settings for every limit, list and pattern. #### Safe by default * Your own IP is added to the allow list on activation, and the dashboard will not let you block an IP or range that contains your own address. * Your server’s own IP (WP-Cron, health checks) is never blocked. * Logged-in users are never rate limited. * Payment gateway callbacks (`wc-api`, Stripe, PayPal and WooCommerce REST) skip the bot checks, so orders are never lost. Add any other callback URL in Settings. * Cloudflare support reads the real visitor IP only from genuine Cloudflare servers, so the header cannot be spoofed. * An emergency off switch: `define( 'CBBG_DISABLE', true );` in `wp-config.php`. #### CB Bot Guard Pro Everything described above is free. A separate Pro add-on is planned for agencies and busy stores. It will add country and network blocking, attack alerts, a shared blocklist across sites, Cloudflare firewall sync, IP reputation checks and weekly reports. ### External services CB Bot Guard does not send data to any third-party service, and it does not phone home. * **Search engine verification.** When a request claims to come from Googlebot, Bingbot, Applebot or Yandex, the plugin performs a reverse and forward DNS lookup of that request’s IP address using your server’s own DNS resolver. The result is cached for a day. No other data is sent. * **Lookup links.** The IP detail page shows links to [AbuseIPDB](https://www.abuseipdb.com/)( [terms](https://www.abuseipdb.com/legal), [privacy](https://www.abuseipdb.com/privacy)) and [ipinfo.io](https://ipinfo.io/) ([terms](https://ipinfo.io/terms-of-service), [privacy](https://ipinfo.io/privacy-policy)). Nothing is sent unless an administrator clicks one of these links, which opens the site in a new tab. ### Privacy The plugin stores, in your own database, the IP address, user agent and requested URL of requests that trigger a rule (for example a flood or a probe). Normal visitors are not logged. Entries are deleted automatically after 14 days (adjustable). Mention this in your privacy policy if your jurisdiction requires it. ## Screenshots [⌊Dashboard with live stats, hourly charts, triggers and top offenders.⌉⌊Dashboard with live stats, hourly charts, triggers and top offenders.⌉[ Dashboard with live stats, hourly charts, triggers and top offenders. [⌊IP Manager: block, unblock or allow IPs and ranges, with bulk actions.⌉⌊IP Manager: block, unblock or allow IPs and ranges, with bulk actions.⌉[ IP Manager: block, unblock or allow IPs and ranges, with bulk actions. [⌊Activity log of suspicious and blocked requests.⌉⌊Activity log of suspicious and blocked requests.⌉[ Activity log of suspicious and blocked requests. [⌊Settings for rate limits, scoring, bot lists and probes.⌉⌊Settings for rate limits, scoring, bot lists and probes.⌉[ Settings for rate limits, scoring, bot lists and probes. ## Installation 1. Install from **Plugins > Add New**, or upload the `cb-bot-guard` folder to `/wp- content/plugins/`. 2. Activate the plugin. Your current IP is added to the allow list automatically. 3. Open **Bot Guard** in the admin menu and click **Turn on early blocking** in the Recommended box. 4. Review **Settings**, especially the SEO and AI crawler lists and **Never check these URLs** if you use a payment gateway with a custom callback URL. 5. Optional, Apache only: preview the rules under **Tools**, then turn on **.htaccess blocking** in Settings. ## FAQ ### Will this slow down my site? No. For a normal visitor the plugin reads one small file and increments one counter. No database queries are added. Blocked bots are answered in a fraction of a millisecond, which frees memory and CPU for real visitors. ### Will it block Google? No. Requests claiming to be Googlebot, Bingbot, Applebot or Yandex are verified with a reverse DNS lookup. Genuine crawlers are marked as Verified and are never rate limited. Only impostors are blocked. ### I locked myself out. What now? Add `define( 'CBBG_DISABLE', true );` to `wp-config.php` using SFTP or your host’s file manager. If .htaccess blocking was on, also delete the lines between `# BEGIN CB Bot Guard` and `# END CB Bot Guard` in `.htaccess`. Log in, add your IP as “Always allow” in the IP Manager, then remove the line from `wp-config.php`. ### Does it work with Cloudflare or another proxy? Yes. Tick **Site is behind Cloudflare** in Settings. For other trusted proxies, use the `cbbg_client_ip` filter to return the real visitor IP. ### Does it work on Nginx or LiteSpeed? Yes. All blocking happens in PHP and works on any server. The optional .htaccess feature only applies to Apache and LiteSpeed servers that read `.htaccess` files. ### Does it work with Jetpack? Jetpack needs XML-RPC. Turn off **Block XML-RPC** in Settings. The dashboard reminds you if Jetpack is active. ### Does it replace my anti-spam plugin? It works alongside it. CB Bot Guard stops abusive traffic and adds a honeypot, and it raises the score of any IP whose comment your anti-spam plugin marks as spam. ### What files does it create? * `wp-content/uploads/cb-bot-guard/`: the compiled blocklist, rate counters and a backup of `.htaccess`. File names include a random key, and the folder is protected from web access on Apache. * `wp-content/mu-plugins/cb-bot-guard-loader.php`: only if you turn on early blocking. * A marked block in `.htaccess`: only if you turn on .htaccess blocking. Deactivating the plugin removes the loader and the `.htaccess` block. Deleting the plugin also removes its database tables, settings and uploads folder. ### Is it multisite compatible? It works per site. Activate it on each site that needs protection. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CB Bot Guard” is open source software. The following people have contributed to this plugin. Contributors * [ Chris M Ybanez ](https://profiles.wordpress.org/chrismaryey02/) [Translate “CB Bot Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/cb-bot-guard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/cb-bot-guard/), check out the [SVN repository](https://plugins.svn.wordpress.org/cb-bot-guard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/cb-bot-guard/) by [RSS](https://plugins.trac.wordpress.org/log/cb-bot-guard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release. ## Meta * Version **1.0.0** * Last updated **2 dies ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/cb-bot-guard/) * Tags * [bot blocker](https://bal.wordpress.org/plugins/tags/bot-blocker/)[firewall](https://bal.wordpress.org/plugins/tags/firewall/) [rate limit](https://bal.wordpress.org/plugins/tags/rate-limit/)[spam](https://bal.wordpress.org/plugins/tags/spam/) [woocommerce](https://bal.wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://bal.wordpress.org/plugins/cb-bot-guard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/cb-bot-guard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/cb-bot-guard/reviews/) ## Contributors * [ Chris M Ybanez ](https://profiles.wordpress.org/chrismaryey02/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/cb-bot-guard/)