Title: Delonix Security Agent Author: delonixteam Published: November 13, 2026 Last modified: November 14, 2026 --- Search plugins ![](https://ps.w.org/delonix-security-agent/assets/banner-772x250.png?rev=3802113) ![](https://ps.w.org/delonix-security-agent/assets/icon-256x256.png?rev=3801056) # Delonix Security Agent By [delonixteam](https://profiles.wordpress.org/delonixteam/) [Download](https://downloads.wordpress.org/plugin/delonix-security-agent.1.0.1.zip) * [Details](https://wordpress.org/plugins/delonix-security-agent/#description) * [Reviews](https://wordpress.org/plugins/delonix-security-agent/#reviews) * [Development](https://wordpress.org/plugins/delonix-security-agent/#developers) [Support](https://wordpress.org/support/plugin/delonix-security-agent/) ## Description Delonix Security Agent focuses on two things: catching scrapers that send realistic browser headers, and keeping real users and site processes untouched. How it works: * Silent verification: a ~3 KB deferred script solves a small SHA- 256 proof-of-work in the background and receives a signed HttpOnly cookie. Visitors see nothing. Clients that do not run JavaScript (curl, python-requests, Scrapy and similar scrapers) are sent to an automatic check page after a few pages. * Verified crawlers: Google, Bing, Apple and DuckDuckGo are verified against their published IP lists (refreshed weekly). Other crawlers use capped reverse DNS. A fake “Googlebot” is challenged. * AI and other bots: AI crawlers such as GPTBot, ChatGPT-User, PerplexityBot and ClaudeBot are allowed by default so AI assistants can cite the site. Claims are checked against published IP lists where they exist. SEO tools and link-preview bots (Telegram, WhatsApp and others) each have their own on/off switch. Bots whose IP cannot be verified get a per-IP rate budget. * Flood protection: a hard per-IP request budget (429) for clients without a verification cookie. Verified visitors on carrier-grade NAT are never affected. * Spam: guest comments and Contact Form 7 submissions are accepted only from verified browsers. Failed logins on wp-login. php and XML-RPC are limited per IP. XML-RPC can optionally be disabled. * Cache safety: challenge and block responses are never cached (DONOTCACHEPAGE plus LiteSpeed no-cache). The verification script is excluded from WP Rocket and LiteSpeed JS optimizations. An optional WP Rocket mandatory cookie serves cached pages only to verified browsers.* Low overhead: counters use a persistent object cache or APCu when available. Otherwise they use one atomic SQL statement, and transients are no longer used. Tokens are stateless HMAC. Logs are throttled per client. The gate runs while plugins load, before the theme. * Never touched: REST API, admin-ajax, wc-ajax, WooCommerce wc- api payment callbacks, feeds, sitemaps, robots.txt, cron and admin. Custom paths and User-Agents can be excluded. * Logged-in users are skipped by default; “Check logged-in users” applies the same checks to them. * Also included: Google Ads click- marker awareness (gclid/gbraid/wbraid), IP/CIDR allow and block lists, trusted proxy support, evidence logging and CSV export. Limitations: a WordPress plugin only sees requests that reach PHP. Large volumetric DDoS attacks need edge protection (a CDN or WAF). Pages served straight from disk by WP Super Cache (expert mode) or W3TC (disk enhanced) bypass PHP, so they cannot be checked. Headless browsers that run JavaScript can pass proof-of-work. Use the rate limits against them. All features described here are included in this plugin, with no account or license, and nothing in it is locked. #### Delonix Security Agent Pro Delonix Security Agent is built by [Delonix](https://delonix.biz). A separate Pro add-on with additional features is available at [delonix.biz](https://delonix.biz/products/security-agent). It is a separate plugin, not hosted on WordPress.org, and this plugin works fully without it. ### External services The plugin works without any account or third-party service. It contacts the services below only in the cases described. No visitor data is sent to any of them. #### Search engine and AI crawler IP lists To confirm that a request claiming to be a known crawler really comes from it, the plugin downloads the IP ranges each operator publishes. This happens once a week by WP-Cron, and when an administrator clicks “Refresh” on the dashboard. Only a plain GET request is made; no site or visitor data is sent. * Google (developers.google.com): [Terms](https://policies.google.com/terms), [Privacy](https://policies.google.com/privacy) * Microsoft Bing (www.bing.com): [Terms](https://www.microsoft.com/servicesagreement), [Privacy](https://privacy.microsoft.com/privacystatement) * Apple (search.developer.apple.com): [Terms](https://www.apple.com/legal/internet-services/terms/site.html), [Privacy](https://www.apple.com/legal/privacy/) * DuckDuckGo (duckduckgo.com): [Terms](https://duckduckgo.com/terms), [Privacy](https://duckduckgo.com/privacy) * OpenAI (openai.com): [Terms](https://openai.com/policies/terms-of-use/), [Privacy](https://openai.com/policies/privacy-policy/) * Perplexity (www.perplexity.com): [Terms](https://www.perplexity.ai/hub/legal/terms-of-service), [Privacy](https://www.perplexity.ai/hub/legal/privacy-policy) #### DB-IP Lite GeoIP database Optional. When an administrator clicks “Download database” in Integrations › IP location, and then monthly while “Monthly automatic update” is on, the plugin downloads the free DB-IP Lite database from download.db-ip.com. Only a plain GET request is made; IP lookups run locally against the downloaded file and never contact DB-IP. The database is licensed under CC BY 4.0. [License](https://db-ip.com/db/lite.php), [Privacy](https://db-ip.com/privacy.php) ### Third-party code * flag-icons 7.6.0, https://github.com/lipis/flag-icons, MIT license (assets/vendor/ flag-icons/). * MaxMind DB Reader 1.14.0, https://github.com/maxmind/MaxMind-DB-Reader-php, Apache 2.0 license (vendor/maxmind-db-reader/). ### Languages The plugin is fully translatable; translations are provided through translate.wordpress. org. It follows the WordPress language: wp-admin uses each user’s profile language, and visitor pages use the site language. Template: languages/delonix-security-agent. pot. ## FAQ ### Do I need an account or the Pro add-on? No. Every feature listed above works without an account, a license key or the Pro add-on. ### Where can I get the Pro add-on or support? See [delonix.biz/products/security-agent](https://delonix.biz/products/security-agent). For questions about this free plugin, use the WordPress.org support forum. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Delonix Security Agent” is open source software. The following people have contributed to this plugin. Contributors * [ delonixteam ](https://profiles.wordpress.org/delonixteam/) [Translate “Delonix Security Agent” into your language.](https://translate.wordpress.org/projects/wp-plugins/delonix-security-agent) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/delonix-security-agent/), check out the [SVN repository](https://plugins.svn.wordpress.org/delonix-security-agent/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/delonix-security-agent/) by [RSS](https://plugins.trac.wordpress.org/log/delonix-security-agent/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Security: a request with a Googlebot User-Agent from Google Cloud / App Engine addresses is no longer accepted as Google’s crawler. Google’s user-triggered fetchers (Site Verification, Feedfetcher, Read Aloud) from those addresses get the per-IP bot budget instead. * Fix: an IP list entry with an empty or invalid prefix length (for example “1.2.3.4/”) no longer matches every address. Invalid entries are reported when settings are saved. * Fix: IPv6 entries in the allow and block lists now match however the address is written (2001:db8::1 and 2001:db8:0:0::1). * Fix: invalid prefix lengths in downloaded crawler IP lists are skipped. * Fix: probe paths such as /.env are checked in the URL path only, so a query string like ?q=/.env is no longer blocked. * Readme: links to the Delonix website and the Pro add-on, and a short FAQ. #### 1.0.0 * First public release. Silent proof-of-work browser verification, official search/ AI crawler IP verification, flood and login rate limits, comment and Contact Form 7 spam protection, evidence event log with CSV export, and GeoIP lookups. ## Meta * Version **1.0.1** * Last updated **15 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [anti-bot](https://wordpress.org/plugins/tags/anti-bot/)[rate limit](https://wordpress.org/plugins/tags/rate-limit/) [scraper](https://wordpress.org/plugins/tags/scraper/)[security](https://wordpress.org/plugins/tags/security/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/delonix-security-agent/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/delonix-security-agent/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/delonix-security-agent/reviews/) ## Contributors * [ delonixteam ](https://profiles.wordpress.org/delonixteam/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/delonix-security-agent/)