Bot Storm Radar

See bot swarms as swarms

Bot attacks no longer come from one address. They come as swarms of thousands of addresses that each make one or two requests, so a tool that judges visitors one by one sees nothing wrong. Bot Storm Radar watches the crowd instead. Every minute it counts how many addresses visited, how many made a single request, how many loaded a stylesheet or a script the way a real browser does and how evenly the browser names are spread. It learns what normal traffic looks like on your site and tells you in plain words when a bot storm is running.

It also protects. A filter that runs before a page is built refuses requests for files only scanners ask for, such as .env, .git, backups and other applications' admin pages, and a single address that keeps probing or asking for missing pages can be banned for a while. Address bans start in observe mode, where they are listed and nobody is refused, until you switch them on.

Features

• Storm score every minute from the single-hit ratio, the asset ratio, user-agent evenness, error pressure and endpoint concentration, weighted by traffic volume.
• Learned baseline. The plugin learns your normal traffic over the first seven days.
• Email alerts on warning, storm and all-clear, each with an explanation in words.
• Verified search bots. Googlebot, Bingbot and the others are verified by reverse DNS and never banned. A user agent alone proves nothing.
• The real visitor address behind Cloudflare and other proxies. Spoofed forwarding headers are ignored.
• Probe refusal before a page is built, on by default.
• Address bans with their evidence and an Unban button, in observe mode first.
• Access logs as sources. Web-server logs can be read through WP-CLI, for traffic that never reaches WordPress.

Two versions

Both are free and share the same radar, settings and ban rules.

• wordpress.org version. Installs and updates from the Plugins screen. It refuses probes and banned addresses as soon as WordPress has loaded its plugins, before the theme, the query or any page is built, and it writes no files, as the plugin directory requires.
• GitHub version. Adds the early gate: probes and banned addresses are refused before WordPress loads, from a must-use plugin, or with early protection on, before WordPress even starts, so a refused request costs no database connection. It also reports probing addresses to AbuseIPDB with your own AbuseIPDB account, prepares an abuse report to the address’s network provider, and updates itself from GitHub releases. New features arrive here first.

Download from GitHub   Source code on GitHub

Requires WordPress 6.0 and PHP 7.4 or higher. A persistent object cache or APCu is recommended. Free and open source under the GPL.