Bot Storm Radar - Support
Help and FAQs for Bot Storm Radar, the plugin that sees bot swarms as swarms, tells you in plain words when a bot storm is running, and refuses scanner probes before a page is built. Browse the FAQ below or use the contact form.
Frequently Asked Questions
Installation
How do I install Bot Storm Radar?
The wordpress.org version: in your WordPress admin go to Plugins → Add New, search for Bot Storm Radar, install and activate it. The GitHub version: download the zip of the latest release, go to Plugins → Add New → Upload Plugin, upload it and activate it. Either way the plugin appears as Bot Storm Radar in the admin menu.What is the difference between the wordpress.org version and the GitHub version?
Both are free and share the same radar, settings and ban rules. The wordpress.org version refuses probes and banned addresses as soon as WordPress has loaded its plugins, before the theme, the query or any page is built, and it writes no files, as the plugin directory requires. The GitHub version adds the early gate, which refuses them before WordPress loads (from a must-use plugin, or with early protection on, before WordPress even starts), reports probing addresses to AbuseIPDB with your own AbuseIPDB account, prepares an abuse report to the address’s network provider, and updates itself from GitHub releases. New features arrive in the GitHub version first. The answers below say when they apply to one version only.Can I switch from one version to the other?
Yes. Deactivate the installed version first, so that its early gate stops. Then upload the other version’s zip (the Download button on wordpress.org, or the latest release on GitHub) under Plugins → Add New → Upload Plugin, choose to replace the installed version, and activate it. Settings, bans and the learned baseline stay; only deleting the plugin removes them.What should I do after activating it?
Leave it running for a week, so it can learn what normal traffic looks like on your site. Then review the thresholds on the Settings tab, and look at the Bans tab before you switch address bans from observe to enforce.Storms and alerts
What do calm, warning, storm and cooling mean?
Every minute the plugin turns its swarm metrics into a storm score from 0 to 100. With the default settings a score of 40 means warning and 60 means storm, and nothing scores at all below 30 distinct addresses in a minute. After a storm, cooling holds for a while before the state goes back to calm. Every change is listed in the storm timeline with an explanation in words.Who gets the alert emails?
The site’s administration email address, until you change it on the Settings tab under Alert email recipients. You choose there whether warning, storm and all-clear each send a mail.Bans and probes
What is a probe?
A request for a file only scanners ask for, such as.env, .git, backups, database dumps, other applications’ admin pages and .php files that do not exist. The plugin answers them with 403 for every visitor, before a page is built, and in the GitHub version before WordPress loads. The full list, a switch and your own exceptions are on the Settings tab under Probes.What is observe mode?
Address bans start in observe mode. An address that would have been banned is listed on the Bans tab with the requests that caused it, and nobody is refused. When the list looks right, switch to enforce on the Settings tab.Can it lock me or a search engine out?
Administrators, verified search bots, Cloudflare and declared proxies, and the addresses on your never-ban list are never banned. An address that claims to be a search bot is verified by DNS first. A ban can be lifted at any time with the Unban button.How do I switch the gate off without wp-admin?
GitHub version: create an empty file nameddisabled in the data directory, wp-content/uploads/bot-storm-radar-<random>/, by SFTP or in your host’s file manager. The gate stops on the next request; delete the file to switch it back on. wordpress.org version: rename or delete the bot-storm-radar folder in wp-content/plugins/. WordPress then stops loading the plugin, and nothing is refused.Compatibility
Does it work behind Cloudflare or another proxy?
Yes. Cloudflare is recognized by its published address ranges. Another proxy has to be declared on the Settings tab, and the plugin tells you when it sees one that is not declared.Does it need an object cache?
No, but a persistent object cache (Redis, Memcached) or APCu is strongly recommended. Without one the counters fall back to the database, and the Radar tab warns about it.What is early protection?
GitHub version only. By default its gate runs from a must-use plugin, after WordPress has connected to the database. Early protection makes it run before WordPress, so a refused request costs no database connection. Leave it off if your host or a security scanner deletes PHP files from the uploads folder.My server runs nginx. Is there anything to add?
Only with the GitHub version, which keeps a data directory: one rule inside the site’sserver block, so that directory is never served: location ^~ /wp-content/uploads/bot-storm-radar- { deny all; }Updates & uninstall
How do I update the plugin?
New versions appear in Dashboard → Updates like any other plugin: from wordpress.org for the wordpress.org version, from GitHub releases for the GitHub version.What happens on uninstall?
Both versions delete their settings, bans, minute history and learned baseline. The GitHub version also removes its must-use loader, its gate files and its state file; its data directory keeps a few-line loader and adisabled marker, which do nothing and can be deleted by hand.Contact Support
Can’t find what you’re looking for? Send us a message and we’ll get back to you within 1–2 business days.Bug Reports & Feature Requests
For bug reports and feature requests, please use the GitHub issue tracker. Please include your plugin version and the steps to reproduce so we can investigate efficiently.