Watrix Bot Guard Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Pages that hold a single form – a contact page, a quote request, a download gate – get hammered by scanners and spam bots. The first real damage is to your analytics: page views are inflated and you can no longer read what visitors actually do.
Watrix Bot Guard catches the source of that traffic with four kinds of rules and lets you decide how to deal with it:
- Path flood – the same IP hitting a specific path (e.g.
/contact/) too many times in a short window - 404 burst – vulnerability scanners walking through hundreds of non-existent URLs
- Trap URL – a hidden link that is disallowed in
robots.txt; only bots that ignore it will ever follow it - Bad User-Agent – empty user agents and signatures of scanners, headless browsers and HTTP libraries
Rules can be added, edited and disabled individually, each with its own paths, threshold, action and block duration.
Record first, block later
Right after activation the plugin runs in log-only mode: every rule records what it sees and nobody is blocked. Look at the dashboard after a few days, see whether the traffic comes from a handful of IPs or is spread out, and only then switch to enforce mode – or take the generated .htaccess / nginx snippet and block those IPs in front of PHP.
What else is included
- Verified crawler exclusion – Googlebot, Bingbot, Applebot and others are let through only after a reverse-then-forward DNS check; a crawler that claims to be Googlebot but fails the check is treated as a fake and blocked
- Allow list with CIDR and IPv6 support for your own office and your client’s office
- Optional grouping by subnet (/24 for IPv4, /64 for IPv6)
- Early blocking – already-blocked IPs are stopped on
init, before the main query runs - Dashboard with per-rule, per-IP, per-path and per-user-agent breakdowns of the last 7 days
- Access log with filters and CSV export
- Manual block list
- Server-side snippets: Apache
.htaccess, nginxdeny, and a plain IP list for your analytics tool’s internal-traffic filter - Settings export / import as JSON to roll the same configuration out to other sites
- WP-CLI:
wp bot-guard top | blocks | block | unblock | mode | export | settings | cleanup - Optional e-mail / webhook notification when a new IP is auto-blocked (throttled to one per hour)
- Daily cleanup of expired blocks and of log rows older than the retention period
What it deliberately does not do
- Login protection and two-factor authentication – there are dedicated plugins for that
- Country blocking – it would require bundling a GeoIP database
Privacy
The plugin stores the IP address, request path, user agent and referrer of requests that match a rule, in your own database, for the retention period you set (30 days by default). Nothing is sent to WATRIX or to any third party. If you configure a webhook URL, block notifications are sent to that URL and nowhere else. An optional “anonymize IP” setting masks the last octet before storing.
The verified-crawler check performs DNS lookups (reverse and forward) against the visitor’s IP. Results are cached for 12 hours.
Screenshots
Overview: per-rule, per-IP, per-path and per-user-agent breakdown of the last 7 days. / 概要画面。ルール別・IP別・パス別・User-Agent別の集計。
Rules: the four built-in rules, each with its own paths, threshold and action. / ルール画面。4種の標準ルール。
Access log: filter by IP, by rule, or by whether the request was blocked. / アクセスログ。IP・ルール・遮断有無で絞り込み。
Server-side blocking: ready-to-paste .htaccess and nginx snippets for the blocked IPs. / サーバー側で遮断。.htaccess / nginx 用スニペット。
Settings: mode switch, exclusions, bad user-agent signatures, trap URL, notifications. / 設定画面。モード・除外・署名・罠URL・通知。
