Description

BotFend Anti-Bot Firewall is a professional-grade WordPress security suite designed to stop automated attacks, malicious bots, and brute-force attempts before they consume your server resources. Built with a high-performance V4 architecture, it features a smart aggregation engine and an early-loading Web Application Firewall (WAF) that neutralizes threats at the server level.

Developed by Omajemite Don, BotFend protects your site without slowing it down.

Core Features:

Advanced Web Application Firewall (WAF): Uses auto_prepend_file via .htaccess or .user.ini to block attacks before WordPress even loads.
Intelligent Bot Detection: Identifies and blocks malicious bots, crawlers, and scrapers using advanced signature detection.
Behavioral Analysis: Monitors visitor behavior patterns to detect and block automated threats that mimic human activity.
Browser Fingerprinting: Generates unique browser fingerprints to track and identify persistent attackers across sessions and IP changes.
Advanced 404 Detection: Detects and blocks malicious path scanning, vulnerability probing, and excessive 404 abuse patterns.
WordPress Protection: Comprehensive protection against XML-RPC attacks, REST API abuse, author scanning, and WordPress-specific vulnerabilities.
Signature Detection: Real-time pattern matching against known attack signatures and malicious payloads.
Smart Log Aggregation: High-performance database architecture that centralizes logging to prevent database bloat and memory crashes, even under heavy attack.
Perpetual Offender Tracking: Automatically upgrades temporary bans to permanent blocks for IPs that repeatedly attack your site.
Real-Time Threat Intelligence: Integrates with external databases to verify IP reputations on the fly.
Tor Node Blocking: Automatically detects and blocks malicious traffic originating from the Tor anonymity network.
Comprehensive UI: Clean, intuitive WordPress admin interface with bulk actions, detailed threat analysis timelines, and visual statistics.

Pro Features (Available with License):

Full Firewall Auto Prepend: Execute firewall protection at the earliest possible stage of WordPress execution
Cloudflare Integration: Synchronize blocked IPs to Cloudflare firewall rules at the edge, blocking attacks before they reach your server

External Services

IMPORTANT: All external services are DISABLED BY DEFAULT. You must explicitly enable each service in the plugin settings before any data is sent.

This plugin can connect to the following external services to provide enhanced threat protection. No data is sent unless you explicitly enable these features.

1. AbuseIPDB API

Purpose: Checks the reputation of suspicious IP addresses against a global database of reported abusers
Data sent: The IP address of the visitor being checked
When: When AbuseIPDB integration is enabled AND an IP address needs verification (cached for 24 hours)
How to disable: Set “Enable AbuseIPDB” to OFF in plugin settings (default: OFF)
Terms of Service: https://www.abuseipdb.com/legal
Privacy Policy: https://www.abuseipdb.com/privacy

2. IPHub API

Purpose: Detects VPNs, proxies, and non-residential IP addresses
Data sent: The IP address of the visitor being checked
When: When IPHub integration is enabled (default: OFF)
How to disable: Set “Enable IPHub” to OFF in plugin settings (default: OFF)
Terms of Service: https://iphub.info/legal/terms
Privacy Policy: https://iphub.info/legal/privacy

3. IP Geolocation Services

Purpose: Determine the country of origin for IP addresses to apply geographic blocking rules
Data sent: The IP address of the visitor being geolocated
When: When geolocation is enabled (default: OFF) AND an IP needs geolocation (results cached)
How to disable: Set “Enable IP Geolocation” to OFF in plugin settings (default: OFF)
Services used:

ip-api.com

Purpose: Primary geolocation service
Terms: https://ip-api.com/terms
Privacy: https://ip-api.com/privacy

ipapi.co

Purpose: Fallback geolocation service
Terms: https://ipapi.co/terms/
Privacy: https://ipapi.co/privacy/

ipwhois.io

Purpose: Secondary fallback geolocation service
Terms: https://ipwhois.io/terms
Privacy: https://ipwhois.io/privacy

4. Tor Project Exit List

Purpose: Downloads the official list of active Tor exit nodes to block anonymous attacks
Data sent: None (only downloads a public list)
When: Every 6 hours when Tor blocking is enabled (default: OFF)
How to disable: Set “Enable Tor Blocking” to OFF in plugin settings (default: OFF)
Service URL: https://check.torproject.org/torbulkexitlist
Terms of Use: https://www.torproject.org/about/trademark/
Privacy Policy: https://www.torproject.org/about/privacy_policy/

5. dan.me.uk Tor List (Alternative Source)

Purpose: Alternative source for Tor exit node list when primary source is unavailable
Data sent: None (only downloads a public list)
When: Only used as fallback when primary Tor list fails and Tor blocking is enabled
How to disable: Disable Tor blocking in plugin settings (default: OFF)
Service URL: https://www.dan.me.uk/torlist/
Terms/Privacy: This is a public service with no formal terms or privacy policy. Use is governed by standard HTTP protocol.

6. Threat Intelligence Feeds

Purpose: Download curated lists of known malicious IP addresses
Data sent: None (only downloads public blocklists)
When: When threat intelligence is enabled (default: OFF) and feeds need refreshing
How to disable: Set “Enable Threat Intelligence” to OFF in plugin settings (default: OFF)
Feeds used:
- FireHOL: https://firehol.org/ (Public domain blocklists)
- Blocklist.de: https://www.blocklist.de/ (Terms: https://www.blocklist.de/en/terms.html)
- Emerging Threats (Proofpoint): Real-time threat intelligence feeds
- Terms: https://www.proofpoint.com/us/legal/license
- Privacy: https://www.proofpoint.com/us/legal/privacy-policy

7. Google reCAPTCHA

Purpose: Provides bot verification on login, registration, and comment forms
Data sent: Browser interaction data sent to Google’s servers
When: When reCAPTCHA is enabled AND a user interacts with a protected form
How to disable: Set reCAPTCHA site key and secret key to empty in plugin settings
Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy

8. Cloudflare API Integration (PRO VERSION)

Purpose: Synchronize blocked IPs to Cloudflare firewall rules at the edge, blocking attacks before they reach your server
Data sent: IP addresses, threat scores, authentication credentials, and configuration parameters during API calls
When: During manual sync operations, scheduled automatic syncs, and license validation
How to disable: Available only in Pro version with valid license
Terms of Service: https://www.cloudflare.com/terms/
Privacy Policy: https://www.cloudflare.com/privacypolicy/

Data Handling Summary

No data is sent to any external service unless you explicitly enable that feature
All API results are cached to minimize external requests
Regular visitor IPs are never sent – only suspicious or attacking IPs trigger external lookups
You can disable ALL external services in the plugin settings
Plugin works perfectly with all external services disabled

Privacy

This plugin respects user privacy:
– No tracking of regular site visitors
– No analytics or usage data collected
– All external services are opt-in (disabled by default)
– Full transparency: All external service calls are documented above

Screenshots

Dashboard overview showing active threat protection and real-time statistics.
Blocklist management with bulk actions and detailed threat analysis.
Detection factors timeline showing exactly why an IP was blocked or challenged.
Advanced configuration settings for fine-tuning protection.
Web Application Firewall (WAF) setup and rule configuration.
Cloudflare integration and IP sync settings (Pro feature).
License activation and Pro feature management.
Security logs with search, filtering, and 404 detection.
Firewall auto-prepend setup for server-level protection (Pro feature).

Installation

Upload the botfend-anti-bot-firewall folder to the /wp-content/plugins/ directory, or install the plugin through the WordPress plugins screen directly.
Activate the plugin through the ‘Plugins’ screen in WordPress.
Navigate to the BotFend menu in your WordPress admin dashboard.
Go to the Settings tab to configure your block durations and enable external threat intelligence (all disabled by default).
(Recommended) Navigate to the Firewall Setup tab and follow the prompts to enable the Advanced Firewall (WAF), which will safely write the necessary rules to your server’s .htaccess or .user.ini file.

FAQ

Will the firewall break my website?: No. BotFend uses safe, standard PHP directives (auto_prepend_file) to load its protection. If it detects a server incompatibility, it will gracefully fall back to standard WordPress-level protection without crashing your site.
Do I need paid API keys for the third-party integrations?: No. The core functionality, including the WAF, smart detection engine, brute-force protection, and Tor blocking, is 100% free and requires no external APIs. AbuseIPDB and IPHub offer generous free tiers if you choose to enable those specific integrations.
Are external services enabled by default?: No. All external services are DISABLED by default. You must explicitly enable each service in the plugin settings if you want to use it. The plugin works perfectly with all external services turned off.
What data is sent to external services?: Only suspicious IP addresses that trigger security rules are ever checked. Regular visitors’ IPs are never sent. When enabled, the plugin sends only the IP address to the respective service. No personal information about your users is ever transmitted.
Does this slow down my database?: No. Version 4 utilizes a “Smart Aggregation” database architecture. Instead of writing thousands of rows during a brute-force attack, it intelligently aggregates duplicate requests into a single row, keeping your database lean and fast.
How do I unblock myself if I get locked out?: You can manually remove your IP from the botfend_blocklist table in your database via phpMyAdmin, or temporarily rename the botfend-anti-bot-firewall folder in wp-content/plugins/ via FTP to disable the plugin and regain access.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“BotFend Anti-Bot Firewall” is open source software. The following people have contributed to this plugin.

Omajemite Don

Translate “BotFend Anti-Bot Firewall” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

4.9.0

Pro Features Added: Full Firewall Auto Prepend and Cloudflare Integration now available with license
Security: All external service URLs updated to working links
Compliance: All third-party services fully documented with Terms of Service and Privacy Policy links
Documentation: Added Emerging Threats (Proofpoint) and dan.me.uk to external services disclosure

4.8.3

Privacy Compliance: All external services now disabled by default (opt-in required)
Security: Added bounded sanitization for all register_setting calls
Storage: Migrated log storage from wp-content to wp-content/uploads with proper .htaccess protection
Escaping: Added esc_attr to all nonce outputs in HTML attributes
Documentation: Updated readme with comprehensive external service documentation including all Terms/Privacy links

4.8.1

Complete rebrand: Plugin renamed to BotFend Anti-Bot Firewall
Security: Implemented rigorous WordPress nonce validation and custom action routing
Architecture: Globalized caching hooks for perfect sync between database and physical firewall cache files
Code Quality: Fixed all WordPress.org review compliance issues

4.5.1

Introduced V4 Smart Aggregation engine for high-performance database logging.
Added auto-prepend Web Application Firewall (WAF) capabilities.
Integrated Tor node blocking and perpetual offender tracking.