Delonix Security Agent focuses on two things: catching scrapers that send realistic browser headers, and keeping real users and site processes untouched.<\/p>\n\n
How it works:\n* Silent verification: a ~3 KB deferred script solves a small SHA-256 proof-of-work in the background and receives a signed HttpOnly cookie. Visitors see nothing. Clients that do not run JavaScript (curl, python-requests, Scrapy and similar scrapers) are sent to an automatic check page after a few pages.\n* Verified crawlers: Google, Bing, Apple and DuckDuckGo are verified against their published IP lists (refreshed weekly). Other crawlers use capped reverse DNS. A fake \"Googlebot\" is challenged.\n* AI and other bots: AI crawlers such as GPTBot, ChatGPT-User, PerplexityBot and ClaudeBot are allowed by default so AI assistants can cite the site. Claims are checked against published IP lists where they exist. SEO tools and link-preview bots (Telegram, WhatsApp and others) each have their own on\/off switch. Bots whose IP cannot be verified get a per-IP rate budget.\n* Flood protection: a hard per-IP request budget (429) for clients without a verification cookie. Verified visitors on carrier-grade NAT are never affected.\n* Spam: guest comments and Contact Form 7 submissions are accepted only from verified browsers. Failed logins on wp-login.php and XML-RPC are limited per IP. XML-RPC can optionally be disabled.\n* Cache safety: challenge and block responses are never cached (DONOTCACHEPAGE plus LiteSpeed no-cache). The verification script is excluded from WP Rocket and LiteSpeed JS optimizations. An optional WP Rocket mandatory cookie serves cached pages only to verified browsers.\n* Low overhead: counters use a persistent object cache or APCu when available. Otherwise they use one atomic SQL statement, and transients are no longer used. Tokens are stateless HMAC. Logs are throttled per client. The gate runs while plugins load, before the theme.\n* Never touched: REST API, admin-ajax, wc-ajax, WooCommerce wc-api payment callbacks, feeds, sitemaps, robots.txt, cron and admin. Custom paths and User-Agents can be excluded.\n* Logged-in users are skipped by default; \"Check logged-in users\" applies the same checks to them.\n* Also included: Google Ads click-marker awareness (gclid\/gbraid\/wbraid), IP\/CIDR allow and block lists, trusted proxy support, evidence logging and CSV export.<\/p>\n\n
Limitations: a WordPress plugin only sees requests that reach PHP. Large volumetric DDoS attacks need edge protection (a CDN or WAF). Pages served straight from disk by WP Super Cache (expert mode) or W3TC (disk enhanced) bypass PHP, so they cannot be checked. Headless browsers that run JavaScript can pass proof-of-work. Use the rate limits against them.<\/p>\n\n
All features described here are included in this plugin, with no account or license, and nothing in it is locked.<\/p>\n\n
Delonix Security Agent is built by Delonix<\/a>. A separate Pro add-on with additional features is available at delonix.biz<\/a>. It is a separate plugin, not hosted on WordPress.org, and this plugin works fully without it.<\/p>\n\n The plugin works without any account or third-party service. It contacts the services below only in the cases described. No visitor data is sent to any of them.<\/p>\n\n To confirm that a request claiming to be a known crawler really comes from it, the plugin downloads the IP ranges each operator publishes. This happens once a week by WP-Cron, and when an administrator clicks \"Refresh\" on the dashboard. Only a plain GET request is made; no site or visitor data is sent.<\/p>\n\n Optional. When an administrator clicks \"Download database\" in Integrations \u203a IP location, and then monthly while \"Monthly automatic update\" is on, the plugin downloads the free DB-IP Lite database from download.db-ip.com. Only a plain GET request is made; IP lookups run locally against the downloaded file and never contact DB-IP. The database is licensed under CC BY 4.0. License<\/a>, Privacy<\/a><\/p>\n\n The plugin is fully translatable; translations are provided through translate.wordpress.org. It follows the WordPress language: wp-admin uses each user's profile language, and visitor pages use the site language. Template: languages\/delonix-security-agent.pot.<\/p>\n\n\nExternal services<\/h3>\n\n
Search engine and AI crawler IP lists<\/h4>\n\n
\n
DB-IP Lite GeoIP database<\/h4>\n\n
Third-party code<\/h3>\n\n
\n
Languages<\/h3>\n\n