Extend WordPress request filtering

BotBlocker Pro is the paid edition of BotBlocker Security. It adds cloud threat intelligence, early traffic filtering, behavioral analysis, malware scanning, security headers, performance controls, and administration tools to the core firewall. The platform intercepts requests through wp-config.php, the MU-add-on phase, and the main shield, so known threats can be blocked before WordPress, themes, or plugins load. For returning visitors, pre-generated PHP runtime files use SHA-256 integrity checks and can load without database queries.

The core platform also includes bot detection, rate limiting, CAPTCHA, two-factor authentication, anti-spam controls, logging, analytics, notifications, and diagnostic tools.

Check traffic and threat patterns

Cloud Threat Intelligence checks attack IP information globally and adds reputation checks for VPNs, Tor, proxies, autonomous systems, and hosting providers. Behavioral and heuristic detection looks for unfamiliar attack patterns before they appear in signature lists. Early Init Mode filters traffic through wp-config.php before WordPress Core loads. It is multisite-aware and may save processing time and memory on blocked requests. Pro also includes self-healing runtime files.

BotBlocker combines User-Agent signatures, additional bot signatures, header checks, and anti-detect scoring to identify automation and headless tools even when User-Agent strings are altered. CAPTCHA protection has nine modes, including Silent Auto-Verify, which is designed to reduce interaction for human visitors.

Scan files and protect configuration

Malware and file integrity

The malware scanner checks files against more than 25 detection patterns, including eval() chains, base64 obfuscation, injected scripts, and webshell markers. A deobfuscation preprocessor works with scans of core, extension, and theme files. The scanner can also check uploads, custom paths, and database content. Scheduled background scans are available. File integrity verification compares WordPress core, plugin, and theme files with known-good references to identify modified, added, or missing files. Per-file and wildcard ignores are supported.

Headers, login, and XML-RPC

Security Headers can be deployed through an MU-plugin before other extensions load. Supported controls include HSTS, CSP with custom domain whitelisting, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy. Hide Login URL lets you set a custom administrator slug and pick whether requests to the default login address receive a 403, a 404, a home redirect, or a custom redirect.

XMLRPC Tunnel offers an allowlisted XML-RPC path with IPv4, IPv6, CIDR, and wildcard entry formats. It supports multi-header real-IP resolution and can automatically block access from addresses outside the allowlist.

Review performance settings

Speed Up WordPress provides 14 listed frontend and server optimizations. Controls include emojis, jQuery Migrate, dashicons, global styles, embeds, RSS feeds, XML-RPC, the WordPress version, shortlinks, and self-pingbacks.

For setup, configure the firewall and CAPTCHA controls first. Then review cloud intelligence, early initialization, login URL, security headers, scanning, file integrity, and XML-RPC settings for the website. Use the analytics, logs, diagnostics, and management tools to review blocked traffic and configuration changes.