BotBlocker Pro

How Pro extends request filtering

BotBlocker Pro is the paid edition of BotBlocker Security. It includes cloud threat intelligence, Early Init Mode, behavioral and heuristic detection, malware scanning, security headers, performance controls, and administration utilities to the core firewall and traffic controls.

The platform checks requests at three layers: wp-config.php, the MU-plugin phase, and the main shield. Known threats can be blocked before WordPress, themes, or extensions load. Pre-generated PHP runtime documents with SHA-256 integrity checks can handle returning visitors without database queries. Core tools also include bot detection, rate limiting, CAPTCHA, two-factor authentication, anti-spam controls, logging, analytics, notifications, and diagnostics.

Cloud reputation and behavior checks

Cloud Threat Intelligence cross-checks attack IP information globally and checks reputation for VPNs, Tor, proxies, autonomous systems, and hosting providers. Behavioral and heuristic detection is intended to identify unfamiliar attack patterns before they appear in signature lists.

Early Init Mode uses boot code in wp-config.php to filter traffic before WordPress Core loads. It is multisite-aware and can save processing time and memory on blocked requests. Self-healing runtime files are also included in the Pro additions.

Bot detection combines User-Agent signatures, additional bot signatures, header checks, and anti-detect scoring. These checks can identify browser automation and headless tools even when User-Agent strings are altered. CAPTCHA protection includes nine modes. Silent Auto-Verify is designed to reduce interaction for human visitors.

Malware scans and file integrity

The malware scanner checks files against more than 25 detection patterns, including eval() chains, base64 obfuscation, injected scripts, and webshell markers. A deobfuscation preprocessor supports scanning WordPress core, extension, and theme files.

File integrity verification compares core, plugin, and theme files with known-good references to identify modified, added, or missing files. Per-file and wildcard ignores are available, along with scheduled background scanning.

Headers, login, and XML-RPC access

Security Headers can deploy through an MU-plugin before other plugins load. Supported controls include HSTS, CSP with custom domain whitelisting, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy.

The login URL can be hidden behind a custom administrator slug. At the default login address, you can pick a 403 or 404 response, a home-page redirect, or a custom redirect.

XMLRPC Tunnel offers an allowlisted XML-RPC path with IPv4, IPv6, CIDR, and wildcard entry formats. It also supports multi-header real-IP resolution and automatic blocking of non-allowlisted access.

Performance options and administration

Speed Up WordPress includes 14 listed frontend and server optimizations. Controls include settings for emojis, jQuery Migrate, dashicons, global styles, embeds, RSS feeds, XML-RPC, the WordPress version, shortlinks, and self-pingbacks.

For setup, configure the firewall and CAPTCHA controls first. Then review cloud intelligence, early initialization, login URL, security headers, scanner, integrity, and XML-RPC settings according to the site's needs. Use analytics, logs, diagnostics, and management tools to review blocked traffic and configuration changes.