How Pro extends WordPress protection

BotBlocker Pro is the paid edition of BotBlocker Security. It adds cloud threat intelligence, Early Init Mode, behavioral and heuristic detection, malware scanning, security headers, performance controls, and administration tools to the core firewall and traffic controls. The underlying platform also includes bot detection, rate limiting, CAPTCHA, two-factor authentication, anti-spam controls, logging, analytics, notifications, and diagnostics.

Requests pass through three interception layers: wp-config.php, the MU-add-on phase, and the main shield. Known threats can be blocked before WordPress, themes, or extensions load. For returning visitors, pre-generated PHP runtime documents use SHA-256 integrity checks and can run without database queries.

Cloud reputation and behavior checks

Cloud Threat Intelligence checks attack IP information globally and adds reputation checks for VPNs, Tor, proxies, autonomous systems, and hosting providers. Behavioral and heuristic detection looks for unfamiliar attack patterns before they appear in signature lists.

Early Init Mode filters traffic through wp-config.php boot code before WordPress Core loads. It is multisite-aware and can save processing time and memory on blocked requests. Pro also includes self-healing runtime files.

Bot detection combines User-Agent signatures, additional bot signatures, header checks, and anti-detect scoring. These signals can identify browser automation and headless tools even when User-Agent strings are altered. CAPTCHA protection has nine modes, including Silent Auto-Verify, which is designed to reduce interaction for human visitors.

File scanning and integrity

The malware scanner checks files for more than 25 patterns, including eval() chains, base64 obfuscation, injected scripts, and webshell markers. A deobfuscation preprocessor works with scans of WordPress core, plugin, and theme files.

File integrity verification compares core, plugin, and theme files with known-good references and can identify files that were modified, added, or removed. Per-file and wildcard ignores are available, as are scheduled background scans.

Headers, login, and XML-RPC controls

Security Headers can deploy through an MU-plugin before other plugins load. Supported controls include HSTS, CSP with custom domain whitelisting, X-Frame-Options, X-Content-Type-Options, and Permissions-Policy.

You can hide the login URL with a custom administrator slug and select what happens at the default login address: return a 403 or 404, redirect to the home page, or use a custom redirect. XMLRPC Tunnel provides an allowlisted XML-RPC path with IPv4, IPv6, CIDR, and wildcard entries. It supports real-IP resolution across multiple headers and automatically blocks access that is not allowlisted.

Performance controls

Speed Up WordPress lists 14 frontend and server optimizations. Settings include controls for emojis, jQuery Migrate, dashicons, global styles, embeds, RSS feeds, XML-RPC, the WordPress version, shortlinks, and self-pingbacks.

Configure Pro for your site

Set up the firewall and CAPTCHA controls first. Then review cloud intelligence, early initialization, login URL behavior, security headers, scanning, file integrity, and XML-RPC access according to your site's needs. Use analytics, logs, diagnostics, and management tools to review blocked traffic and configuration changes.