First release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3745400,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3745400,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3745400,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3745400,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3745400,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3745400,"resolution":"1","location":"assets","locale":"","width":1547,"height":862},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3745400,"resolution":"2","location":"assets","locale":"","width":1524,"height":490},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3745400,"resolution":"3","location":"assets","locale":"","width":1545,"height":839},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3745406,"resolution":"4","location":"assets","locale":"","width":1533,"height":864}},"screenshots":{"1":"Dashboard with live stats, hourly charts, triggers and top offenders.","2":"IP Manager: block, unblock or allow IPs and ranges, with bulk actions.","3":"Activity log of suspicious and blocked requests.","4":"Settings for rate limits, scoring, bot lists and probes.","5":"Tools: early blocking, .htaccess preview, import and export."}},"plugin_section":[],"plugin_tags":[13859,1174,171765,599,286],"plugin_category":[45,54],"plugin_contributors":[281392],"plugin_business_model":[],"class_list":["post-382786","plugin","type-plugin","status-publish","hentry","plugin_tags-bot-blocker","plugin_tags-firewall","plugin_tags-rate-limit","plugin_tags-spam","plugin_tags-woocommerce","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-chrismaryey02","plugin_committers-chrismaryey02"],"banners":{"banner":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/banner-772x250.png?rev=3745400","banner_2x":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/banner-1544x500.png?rev=3745400","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/icon.svg?rev=3745400","icon":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/icon.svg?rev=3745400","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/screenshot-1.png?rev=3745400","caption":"Dashboard with live stats, hourly charts, triggers and top offenders."},{"src":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/screenshot-2.png?rev=3745400","caption":"IP Manager: block, unblock or allow IPs and ranges, with bulk actions."},{"src":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/screenshot-3.png?rev=3745400","caption":"Activity log of suspicious and blocked requests."},{"src":"https:\/\/ps.w.org\/cb-bot-guard\/assets\/screenshot-4.png?rev=3745406","caption":"Settings for rate limits, scoring, bot lists and probes."}],"raw_content":"\n
Bad bots don't just spam forms. They hammer search pages, product filters and add-to-cart links, and every one of those requests makes WordPress and WooCommerce build a full page. On shared hosting and small VPS plans, that is what pushes memory over the limit and takes the site down.<\/p>\n\n
CB Bot Guard spots these clients and answers them with a tiny 403 or 429 response, before your theme and plugins do any work. Real visitors are not affected.<\/p>\n\n
.env<\/code>, .git<\/code>, phpMyAdmin, Adminer and common web shells.<\/li>\n- XML-RPC abuse, failed logins and 404 floods.<\/strong><\/li>\n
- Spam forms.<\/strong> A hidden honeypot field on comment and registration forms (WordPress and WooCommerce). Comments that your anti-spam plugin marks as spam also count against the sender.<\/li>\n<\/ul>\n\n
Each event adds points to the IP. When it reaches the threshold (10 by default) the IP is blocked for 24 hours. Repeat offenders are blocked for 7 days, then permanently. Every number is adjustable.<\/p>\n\n
Built to save resources<\/h4>\n\n\n- Early blocking (one click).<\/strong> An optional must-use loader runs the blocklist check before other plugins load. In testing, a blocked request used about 3 MB of memory instead of a full page load, with no measurable cost for real visitors.<\/li>\n
- Server-level blocking (optional, Apache).<\/strong> Blocked IPs can be written into
.htaccess<\/code> so they never start PHP at all. You can preview the rules first, and a backup is saved before every change.<\/li>\n- No database queries for normal visitors.<\/strong> Only suspicious or blocked traffic is logged. Counts for blocked requests are buffered and saved every 5 minutes.<\/li>\n
- Uses APCu for counters when available, otherwise small files.<\/li>\n<\/ul>\n\n
Dashboard<\/h4>\n\n\n- Live stats and 24-hour charts of stopped requests and suspicious events.<\/li>\n
- IP Manager: block, unblock or always-allow single IPs, CIDR ranges (
1.2.3.0\/24<\/code>) and wildcards (1.2.3.*<\/code>). Bulk actions, search, sorting and a detail page for every IP.<\/li>\n- Activity log with filters.<\/li>\n
- Import and CSV export.<\/li>\n
- Settings for every limit, list and pattern.<\/li>\n<\/ul>\n\n
Safe by default<\/h4>\n\n\n- Your own IP is added to the allow list on activation, and the dashboard will not let you block an IP or range that contains your own address.<\/li>\n
- Your server's own IP (WP-Cron, health checks) is never blocked.<\/li>\n
- Logged-in users are never rate limited.<\/li>\n
- Payment gateway callbacks (
wc-api<\/code>, Stripe, PayPal and WooCommerce REST) skip the bot checks, so orders are never lost. Add any other callback URL in Settings.<\/li>\n- Cloudflare support reads the real visitor IP only from genuine Cloudflare servers, so the header cannot be spoofed.<\/li>\n
- An emergency off switch:
define( 'CBBG_DISABLE', true );<\/code> in wp-config.php<\/code>.<\/li>\n<\/ul>\n\nCB Bot Guard Pro<\/h4>\n\n
Everything described above is free. A separate Pro add-on is planned for agencies and busy stores. It will add country and network blocking, attack alerts, a shared blocklist across sites, Cloudflare firewall sync, IP reputation checks and weekly reports.<\/p>\n\n
External services<\/h3>\n\n
CB Bot Guard does not send data to any third-party service, and it does not phone home.<\/p>\n\n
\n- Search engine verification.<\/strong> When a request claims to come from Googlebot, Bingbot, Applebot or Yandex, the plugin performs a reverse and forward DNS lookup of that request's IP address using your server's own DNS resolver. The result is cached for a day. No other data is sent.<\/li>\n
- Lookup links.<\/strong> The IP detail page shows links to AbuseIPDB<\/a> (terms<\/a>, privacy<\/a>) and ipinfo.io<\/a> (terms<\/a>, privacy<\/a>). Nothing is sent unless an administrator clicks one of these links, which opens the site in a new tab.<\/li>\n<\/ul>\n\n
Privacy<\/h3>\n\n
The plugin stores, in your own database, the IP address, user agent and requested URL of requests that trigger a rule (for example a flood or a probe). Normal visitors are not logged. Entries are deleted automatically after 14 days (adjustable). Mention this in your privacy policy if your jurisdiction requires it.<\/p>\n\n\n
\n- Install from Plugins > Add New<\/strong>, or upload the
cb-bot-guard<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n- Activate the plugin. Your current IP is added to the allow list automatically.<\/li>\n
- Open Bot Guard<\/strong> in the admin menu and click Turn on early blocking<\/strong> in the Recommended box.<\/li>\n
- Review Settings<\/strong>, especially the SEO and AI crawler lists and Never check these URLs<\/strong> if you use a payment gateway with a custom callback URL.<\/li>\n
- Optional, Apache only: preview the rules under Tools<\/strong>, then turn on .htaccess blocking<\/strong> in Settings.<\/li>\n<\/ol>\n\n\n
\nWill this slow down my site?<\/h3><\/dt>\nNo. For a normal visitor the plugin reads one small file and increments one counter. No database queries are added. Blocked bots are answered in a fraction of a millisecond, which frees memory and CPU for real visitors.<\/p><\/dd>\n
Will it block Google?<\/h3><\/dt>\nNo. Requests claiming to be Googlebot, Bingbot, Applebot or Yandex are verified with a reverse DNS lookup. Genuine crawlers are marked as Verified and are never rate limited. Only impostors are blocked.<\/p><\/dd>\n
I locked myself out. What now?<\/h3><\/dt>\nAdd define( 'CBBG_DISABLE', true );<\/code> to wp-config.php<\/code> using SFTP or your host's file manager. If .htaccess blocking was on, also delete the lines between # BEGIN CB Bot Guard<\/code> and # END CB Bot Guard<\/code> in .htaccess<\/code>. Log in, add your IP as \"Always allow\" in the IP Manager, then remove the line from wp-config.php<\/code>.<\/p><\/dd>\nDoes it work with Cloudflare or another proxy?<\/h3><\/dt>\nYes. Tick Site is behind Cloudflare<\/strong> in Settings. For other trusted proxies, use the cbbg_client_ip<\/code> filter to return the real visitor IP.<\/p><\/dd>\nDoes it work on Nginx or LiteSpeed?<\/h3><\/dt>\nYes. All blocking happens in PHP and works on any server. The optional .htaccess feature only applies to Apache and LiteSpeed servers that read .htaccess<\/code> files.<\/p><\/dd>\nDoes it work with Jetpack?<\/h3><\/dt>\nJetpack needs XML-RPC. Turn off Block XML-RPC<\/strong> in Settings. The dashboard reminds you if Jetpack is active.<\/p><\/dd>\nDoes it replace my anti-spam plugin?<\/h3><\/dt>\nIt works alongside it. CB Bot Guard stops abusive traffic and adds a honeypot, and it raises the score of any IP whose comment your anti-spam plugin marks as spam.<\/p><\/dd>\n
What files does it create?<\/h3><\/dt>\n\nwp-content\/uploads\/cb-bot-guard\/<\/code>: the compiled blocklist, rate counters and a backup of .htaccess<\/code>. File names include a random key, and the folder is protected from web access on Apache.<\/li>\nwp-content\/mu-plugins\/cb-bot-guard-loader.php<\/code>: only if you turn on early blocking.<\/li>\n- A marked block in
.htaccess<\/code>: only if you turn on .htaccess blocking.<\/li>\n<\/ul>\n\nDeactivating the plugin removes the loader and the .htaccess<\/code> block. Deleting the plugin also removes its database tables, settings and uploads folder.<\/p><\/dd>\nIs it multisite compatible?<\/h3><\/dt>\nIt works per site. Activate it on each site that needs protection.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.0.0<\/h4>\n\n\n- First release.<\/li>\n<\/ul>","raw_excerpt":"Stop spam bots, scrapers and request floods before they load WordPress and WooCommerce, and cut server RAM and CPU spikes.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/382786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=382786"}],"author":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/chrismaryey02"}],"wp:attachment":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=382786"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=382786"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=382786"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=382786"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=382786"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=382786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}