Bot Storm Radar

See bot swarms as swarms

Bot attacks no longer come from one address. They come as swarms of thousands of addresses that each make one or two requests, so a tool that judges visitors one by one sees nothing wrong. Bot Storm Radar watches the crowd instead. Every minute it counts how many addresses visited, how many made a single request, how many loaded a stylesheet or a script the way a real browser does and how evenly the browser names are spread. It learns what normal traffic looks like on your site and tells you in plain words when a bot storm is running.

It also protects. A filter that runs before WordPress loads refuses requests for files only scanners ask for, such as .env, .git, backups and other applications' admin pages, and a single address that keeps probing or asking for missing pages can be banned for a while. Address bans start in observe mode, where they are listed and nobody is refused, until you switch them on.

Features

• Storm score every minute from the single-hit ratio, the asset ratio, user-agent evenness, error pressure and endpoint concentration, weighted by traffic volume.
• Learned baseline. The plugin learns your normal traffic over the first seven days.
• Email alerts on warning, storm and all-clear, each with an explanation in words.
• Verified search bots. Googlebot, Bingbot and the others are verified by reverse DNS and never banned. A user agent alone proves nothing.
• The real visitor address behind Cloudflare and other proxies. Spoofed forwarding headers are ignored.
• Probe refusal before WordPress loads, on by default.
• Address bans with their evidence and an Unban button, in observe mode first.
• Access logs as sources. Web-server logs can be read through WP-CLI, for traffic that never reaches WordPress.

Requires WordPress 6.0 and PHP 7.4 or higher. A persistent object cache or APCu is recommended. Free and open source under the GPL.