ScrapeFence Content Protection

Description

What ScrapeFence Does for You

🍯 Honeypot Traps
Automatically inserts invisible fake links that only bots can see. When a bot clicks them, it gets trapped in an endless loop of fake pages, wasting its time and resources — your real content stays safe.

⚡ Rate Limiting
Detects when a single IP requests too many pages too fast (a clear sign of scraping) and either locks the IP out or traps it in a honeypot. Real human visitors never hit the limit.

🔑 Brute Force Protection
Watches for repeated failed logins, 404s, and 403 errors from the same IP. When a threshold is reached, the IP is automatically blocked or sent into a trap. Search engine bots are never affected.

⏱️ Cron Attack Defense
Stops abuse of WordPress’s wp-cron.php by limiting how often non‑allowlisted IPs can trigger it, preventing server resource drain.

🌐 IP Allowlist & UA Blocklist
Comes preloaded with the IP ranges of Google, Bing, Baidu, Yandex, and other major search engines — they will never be blocked. You can also block known scraper User‑Agents with a simple list.

📡 REST API Protection
Locks down the WordPress REST API for unauthenticated visitors, preventing scrapers from harvesting your posts as raw JSON data.

🛡️ Frontend Protection
Disable right‑click, F12, text selection, and image dragging on the front end. Optionally add a copyright notice that appears whenever someone copies text from your site.

📊 Dashboard & Logs
See today’s blocked requests, total blocks, active traps, and a 7‑day trend chart. Browse a full, searchable log of every blocked IP, complete with status filters and bulk actions.

🧙 Setup Wizard
On activation, a simple 3‑step wizard guides you through adding your own IP to the allowlist, detecting caching plugins, and getting basic protection running in under a minute.

🌍 Fully Bilingual
Speaks your language — automatically switches between English and Chinese based on your WordPress settings.

Why ScrapeFence

  • SEO‑safe – Real search engines are pre‑allowlisted. Honeypot pages use noindex. You won’t lose rankings.
  • You won’t block yourself – Admins are always exempt, and the setup wizard makes sure your own IP is safe.
  • Active trapping, not just blocking – Honeypots actively waste scrapers’ resources, instead of simply saying “no”.
  • Lightweight & focused – Does one job and does it well, without slowing down your site.

Looking for even more advanced protection (behavior detection, DNS verification, burst protection)? Upgrade to ContentGuard Pro at contentguard.top.

Privacy Notice

ScrapeFence stores IP addresses and User‑Agent strings of visitors who trigger security rules (e.g., rate limiting, honeypot traps, brute force attacks). This data is kept only on your server, never sent anywhere else, and is automatically cleaned up after 30 days. You can clear all logs at any time from the Maintenance page. No cookies are placed on visitors’ browsers.

Installation

  1. Upload the scrapefence folder to /wp-content/plugins/.
  2. Activate the plugin through the ‘Plugins’ menu.
  3. Follow the automatic setup wizard at ScrapeFence Setup Wizard.
  4. Important: Add your own IP to the allowlist during Step 2.

FAQ

Will this affect my SEO?

No. Search engine IPs are pre‑allowlisted, and honeypot pages include noindex, nofollow tags. Real crawlers never see the traps.

Can I block myself?

No. Logged‑in administrators are always exempt. The wizard also forces you to add your IP to the allowlist before you can finish setup.

Is there a Pro version?

Yes. ContentGuard Pro adds behavior detection, probe detection, burst protection, reverse DNS verification, and more. Learn more at contentguard.top.

How do I test the honeypot?

Enable “Manual Honeypot” in the settings, then visit ?cgtrap=1 from an IP that is not in your allowlist.

Does it work with caching plugins?

Yes. If you use full‑page caching, exclude any URL containing cgtrap from the cache. The wizard and dashboard will detect your caching plugin and show you the exact rule to add.

What data does the plugin collect?

None externally. All logs live entirely on your own server.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“ScrapeFence Content Protection” is open source software. The following people have contributed to this plugin.

Contributors

Changelog

1.4.5

  • Security: Full sanitization of all $_SERVER inputs (HTTP headers, REQUEST_URI).
  • Compliance: Fixed text domain to match plugin slug.
  • Compliance: Replaced direct <script> tags with wp_add_inline_script.
  • Performance: Optimized cache key prefixes to avoid conflicts.

1.4.4

  • Compliance: Rewrote translation system using WordPress standard functions (__(), load_plugin_textdomain) for WordPress.org submission.
  • Performance: Moved log table cleanup to daily cron to reduce database load.
  • Fix: Version tag alignment in readme.

1.4.3

  • Improved: Honeypot links now use more stealthy hiding styles and dynamic anchor text.
  • Improved: Trap pages now feature realistic theme headers, real post titles, delayed link clicks, and Proof‑of‑Work to exhaust bots.
  • Improved: Dashboard “Safe Passes Today” now includes DNS verification passes when Pro is active.
  • Improved: Blocked/trapped IPs are now globally intercepted on all subsequent requests.
  • Improved: Log table now retains up to 1000 records per reason for better performance.
  • Improved: DNS verification pass now grants temporary allowlist status for 12 hours (Pro).
  • Improved: Probe detection now checks WebGL renderer consistency and Canvas fingerprint (Pro).
  • Fixed: Status labels in IP manager now correctly reflect real‑time block/trap state.
  • Fixed: Trend chart now uses counter data to avoid missing historical data.
  • Fixed: Several edge‑case logic errors in behavior detection, burst protection, and DNS verification.
  • Security: Replaced all direct error_log calls with a controlled internal logging function.
  • Security: Added rate limiting to the dynamic configuration AJAX endpoint.

1.4.2

  • Initial release on WordPress.org.
  • Core features: honeypot traps, rate limiting, IP allowlist/blocklist, REST API control, frontend protection.
  • New in free: brute force protection and cron attack defense.
  • New: admin IP safety status card on dashboard.
  • New: bulk actions in block log.
  • New: settings export/import via JSON.
  • Improved: setup wizard enforces admin IP allowlisting.
  • Improved: 7‑day trend chart colors match plugin theme.
  • Full bilingual English/Chinese support.