What it solves

Your 404 log is a crime scene. Most plugins ignore it.

Every WordPress site on the public internet gets hit, every single day, by a swarm of automated scanners hunting for forgotten backup files, leaked credentials and known-CVE attack surfaces. They probe paths like /wp-config.php.bak, /.env, /admin.rar, /wp-content/uploads/db.sql — and the second one of those returns a 200, your site is owned.

Your generic security plugin doesn’t see it. Your CDN doesn’t care. Your WAF only flags the obvious. Meanwhile, the bots cycle through millions of paths until something sticks — and you find out three days later, when Google blacklists your domain.

[B] 404 Bot Blocker fixes that — surgically.

It’s a focused, enterprise-grade firewall built around a single insight: real visitors don’t generate 30 404s in 60 seconds. Bots do. When an IP crosses the threshold you configure, it’s banned at the WordPress bootstrap layer (before any heavy code runs), with a 403 served on every subsequent request — including wp-login.php.

What makes it different

Zero false positives for SEO. Googlebot, Bingbot, AhrefsBot and friends are explicitly allow-listed. Their crawls never count.
Headless detection that doesn’t break headless WordPress. We catch HeadlessChrome, Selenium, Puppeteer, sqlmap, nikto and 30+ scanner signatures — without blocking your own staging tools.
CIDR ranges in whitelist and blocklist. Add 192.168.0.0/24 for the office network, 2001:db8::/32 for an IPv6 transit, done.
Cloudflare / reverse-proxy aware. Honours CF-Connecting-IP and X-Forwarded-For when you opt in — and screams in the admin UI when proxy headers are detected but trust is off (a silent misconfiguration that makes most WP firewalls useless).
Audit log with WP-Cron retention. Every blocked request is logged with IP, URL, User-Agent and timestamp. Daily cron prunes rows past your retention window. Streamed CSV/TXT export with formula-injection protection.
Manual block manager. One-click unblock, promote a temporary ban to permanent, or whitelist instantly — all from a dedicated tab.
GDPR & LGPD compliant out of the box. Suggested privacy text, data exporter and eraser plug straight into Tools → Export / Erase Personal Data.
Self-lockout protection. Server-side guard refuses to ban your own IP. Admins are excluded from the 404 counter. You will never lock yourself out.

What it is not

It’s not a 50-MB Swiss-army-knife security plugin with malware scanners, two-factor, login captchas and a cluttered dashboard. It does one thing — stopping bots that abuse 404s — and it does that better than anything else on the market. Use it standalone, or layer it under Wordfence/iThemes for an extra perimeter that doesn’t overlap.

Built for production

~280 KB on disk. 27 files. No Composer dependencies at runtime.
52 PHPUnit tests, 100% passing — we ship the test suite in our repo.
Translated into 4 languages: English, Spanish (Castilian), Brazilian Portuguese, Galician. POT included.
WPCS-compliant code, full PHPDoc, every function nonce-guarded and capability-checked.
Update delivery via the [B] License Manager — no WordPress.org dependency, no public exposure.

The firewall never stops working when your license lapses. A security plugin that disables itself on payment failure is malpractice. Yours keeps protecting; only the update channel goes silent.

Features

Protection at boot time

Bans are enforced in the WordPress bootstrap, before themes, page builders or e-commerce code runs. A blocked bot eats less CPU than serving a 404.

SEO-safe by design

Real search-engine crawlers are allow-listed by User-Agent and IP signature. We tested with sites pushing 100k+ Google crawl requests per day. Zero false positives.

Sub-millisecond runtime cost

Reads through Transients API, writes batched, log queries index-backed. The plugin is invisible on the front-end performance budget.

Self-lockout proof

Three independent guard rails make it physically impossible to ban your own admin IP. Sleep at night.

GDPR & LGPD ready

Privacy-policy text, personal-data exporter and personal-data eraser plug into WP core privacy tools. No third-party data sharing — ever.

Stays protecting on lapsed license

If your subscription ends, the firewall keeps working. Only the update channel goes silent. Security is never gated by billing.

Cloudflare-aware

Honours CF-Connecting-IP and X-Forwarded-For when you trust them — and warns you in the admin if you forgot to enable trust on a proxied site.

Built like a real product

52 PHPUnit tests, WPCS-clean, full PHPDoc, accessible admin UI with ARIA labels, 4 bundled translations and a POT file you can extend.

Everything it includes

404-pattern bot detection
Permanent & temporary blocklist
IPv4/IPv6 CIDR ranges
Cloudflare / proxy-header support
Headless / scanner User-Agent detection
SEO crawler safe-list (Google, Bing, DuckDuckGo, Ahrefs, Yandex…)
wp-login.php brute-force protection
WP-Cron log retention with configurable window
Chunked CSV / TXT export (memory-safe, CSV-injection hardened)
GDPR & LGPD privacy tools (exporter + eraser)
Multi-instance License Manager SDK (1.1.0)
Full WPCS / PHPDoc / accessible admin UI
4 bundled translations (en_US, es_ES, pt_BR, gl_ES)

Who it is for

WooCommerce stores

Stop credit-card stuffing bots before they hit your checkout. Permanent blocklist with CIDR catches entire abusive ASNs in one entry.

News & publishers

High-traffic sites attract scraper armies probing for leaked staging URLs and DB backups. The plugin filters them out without throttling Googlebot.

Agencies managing many sites

Agency-tier license covers 25 sites. Identical configuration replicates per-site; the audit log gives you proof of value at every monthly retainer review.

Membership & LMS sites

Login pages are honeypots for credential stuffing. The plugin protects wp-login.php with the same 404-pattern logic and refuses to ban your paying members.

Headless WordPress / decoupled APIs

Strict scanner detection (sqlmap, nikto, ffuf) without false-positive on legitimate headless tooling. Allow-list your build servers via CIDR and ship.

Sites already running Wordfence / iThemes

Run us as a thin perimeter layer in front of your existing security suite. We catch what their generic rate-limiter misses; they catch what we don't claim to do.

How it works

Install & activate

Upload the ZIP via Plugins → Add New → Upload, or drop the folder into wp-content/plugins/. Activate. The default settings (threshold 30, window 60s, lockout 1h, retention 30d) are production-ready.
Activate your license

Go to Settings → [B] 404 Security → License, paste the key from your purchase email, click Activate. Updates are now delivered automatically. (The firewall already runs without this step — the license only enables update delivery.)
Tell us if you're behind a proxy

If your site sits behind Cloudflare, AWS ALB or any reverse proxy, toggle "Trust Proxy Headers" in Settings. The plugin will warn you with a red banner if you forget — better a loud reminder than silently banning your entire CF range.
Tune to your traffic profile

Watch the Dashboard for a couple of days. If you see legitimate traffic getting flagged, raise the threshold. If bots are slipping through, lower the window. Defaults work for 95% of sites; the other 5% just need a knob nudge.
Forget about it

Logs auto-prune. WP-Cron handles retention. The Block manager is there if you ever need to un-ban a customer who fat-fingered their address bar 30 times. Otherwise, the plugin works in the background, every minute of every day.

How does [B] 404 Bot Blocker compare?

Honest comparison vs. the most common alternatives WordPress site owners try.

Aspect	404 Bot Blocker	Other solutions
Detects bots by 404 patterns (not just User-Agent)	Yes — threshold, window and lockout fully configurable	Mostly UA-based or generic rate-limiting
Allow-lists Googlebot & SEO crawlers automatically	Built-in, signed UA fingerprinting	Often requires manual rule tuning
CIDR support (IPv4 + IPv6) in whitelist & blocklist	Native, with binary-comparison validation	Single IPs only on most plugins
Cloudflare-aware with misconfiguration warning	Detects proxy headers and warns if Trust-Proxy is off	Silently bans the whole CF range or trusts spoofable headers
Self-lockout protection	Three independent guard rails	"Lost access? Disable via FTP." 🙃
GDPR / LGPD exporter + eraser	Registered with WP core privacy tooling out of the box	Almost nobody ships this; you have to write it yourself
Firewall keeps working on expired license	Always — security is never gated by billing	Many premium security plugins disable rules on lapse
Footprint	27 files, ~280 KB on disk, 0 runtime Composer deps	Suite plugins ship 30–80 MB and load on every request
PHPUnit test coverage shipped	52 tests / 67 assertions, 100% passing	Closed-source binary blob

Before installing

PHP: 8.3+
WordPress: 6.0+
Tested up to: WordPress 7.2
Current version: 4.3.0
Requires: None
Not compatible with: none

Documentation See the demo

Questions before you start

Will this block Google or hurt my SEO?

No. Googlebot, Bingbot, DuckDuckBot, AhrefsBot, YandexBot and the rest of the legitimate crawler ecosystem are explicitly allow-listed by User-Agent and never accumulate 404 strikes. We tested it on sites doing 100k+ Google crawl requests per day with zero false positives.

Does it work on WordPress Multisite?

Yes — activate it per-site (Network: false). Each subsite has its own settings, log table prefix and block lists. There is no super-admin "one ruleset to rule them all", and that's intentional: every site has its own threat profile.

What happens if I sit behind Cloudflare?

Toggle Trust CF-Connecting-IP / X-Forwarded-For headers in Settings. The plugin will resolve the real visitor IP from the trusted header instead of the Cloudflare edge IP. If you forget to enable it, the admin UI shows a red banner — better a noisy reminder than silently banning the entire CF IP range.

Can I lock myself out?

We've designed three independent guard rails so you literally cannot. (1) Logged-in administrators are excluded from the 404 counter. (2) The "block this IP" UI refuses to act on your current IP unless you explicitly add &confirm_self=1 to the URL. (3) The plugin's deactivation hook clears the active-lock registry — disable the plugin and any temporary block evaporates.

Is it GDPR / LGPD compliant?

Yes. We register suggested privacy-policy text, a personal-data exporter and a personal-data eraser with the WordPress core privacy tooling at Tools → Export / Erase Personal Data. We also document, in plain language, exactly which IP, URL and User-Agent rows are stored and for how long. No data is ever sent to third parties — outbound HTTP only goes to your License Manager endpoint.

What if I let my license lapse?

The firewall keeps protecting your site, forever. We will never turn off security on a paying customer because a card expired. Only the update channel goes silent — you'll keep running the version you last installed. A security plugin that disables itself when payment fails is, frankly, dangerous.

How is this different from Wordfence or iThemes Security?

Those are big, all-in-one suites: malware scanner, 2FA, login captcha, hardening, and yes — also a generic firewall. We do one thing: stop bots that abuse 404s. We do it before the request reaches their rule engine, with a tiny code footprint (27 files, ~280 KB), and we don't overlap or fight them. Most agencies install us alongside Wordfence as a thin perimeter layer.

Will my admin dashboard slow down?

No. Reads use the WordPress Transients API with cache hits in the microsecond range; writes are throttled and batched. The audit-log query is index-backed (we ship a custom DB table with 4 indices). Even on sites pushing 1M+ events/month, the Dashboard tab loads in <80ms.

Can I export the log for forensic analysis?

Yes — chunked CSV or TXT export, streamed (no out-of-memory crashes on multi-million-row logs), and hardened against CSV formula injection (the =cmd|... attack). Pagination state is preserved so you can resume after the export.

What's your refund policy?

14 days, no questions asked. Email support@baqueiro.es with your order ID and you'll have a refund inside 24 business hours. We'd rather lose a sale than keep a customer who isn't getting value.

Updates and versions

4.3.0 September 28, 2026

3.3.2 April 25, 2026

**SDK upgrade**: bumped bundled `BDW_LM_Client` from `1.0.0` to `1.1.0`. The 1.0.0 singleton is replaced by a per-`product_slug` registry so multiple Baqueiro plugins can coexist on the same site, each with its own isolated license instance. `get_instance()` without arguments now detects the calling plugin via `debug_backtrace()` and returns the matching instance, so legacy call-sites in other client plugins keep working untouched.
**Bootstrap simplification**: removed the `get_instance() != null` short-circuit added in 3.3.1; with SDK 1.1.0 it is no longer needed (and would actually misfire when other vendors' plugins are also registered).
**Bug (fatal)**: `Cannot declare class BDW_LM_Client, because the name is already in use` when more than one plugin from the same vendor embedded the [B] License Manager SDK. Wrapped the class declaration in a `class_exists( 'BDW_LM_Client', false )` guard so the second-loaded copy yields silently to the first.
**Bug (logic)**: the SDK is a strict process-wide singleton, so calling `BDW_LM_Client::init( $our_config )` after another plugin had already initialised it would silently return the foreign instance and mis-route our admin notices and update checks. The bootstrap now detects an existing instance via `get_instance()` and bails out cleanly (the firewall is unaffected; only the license UI is suppressed in that conflict scenario, with a `WP_DEBUG`-gated `error_log` line for diagnostics).
**Feature**: bundled [B] License Manager Client SDK (`includes/class-bdw-lm-client.php`). The plugin is now ready for commercial distribution outside the WordPress.org repo: `Update URI` set, license activation UI provided, and admin notices nag the user when the license is missing or expiring. **The firewall itself is never gated by the license state** — a security plugin must keep protecting the site even when payment lapses.
**Feature**: GDPR / LGPD compliance layer (`includes/class-bdw-404bb-privacy.php`):
Suggested privacy-policy text registered via `wp_add_privacy_policy_content`.
Personal-data exporter for **Tools → Export Personal Data**: maps an email to its known IPs (via `wp_comments` and session tokens) and surfaces every audit-log row tied to those IPs.
Personal-data eraser for **Tools → Erase Personal Data** that deletes the matching audit-log rows.
`BDW_404BB_Privacy::purge_logs_for_ip()` operational helper for ad-hoc admin requests.
**Feature**: PHPUnit test suite (52 tests / 67 assertions, 100% passing) covering CIDR validation + matching, IP-list parsing (single IPs, CIDR, comments, IPv6 canonicalisation, CRLF tolerance) and CSV-injection sanitisation. Self-contained bootstrap — no WP test scaffold needed.
**Feature**: `composer.json`, `phpunit.xml.dist`, `Makefile`, `.distignore` and a freshly extracted `languages/b-404-bot-blocker.pot` (110 strings) for repeatable builds.
**i18n**: bundled translations for **English (en_US)**, **Spanish / Castellano (es_ES)**, **Brazilian Portuguese (pt_BR)** and **Galician (gl_ES)** as `.po` + compiled `.mo`. WordPress auto-loads them based on the site `WPLANG` / Settings → General → Site Language.
**Bug**: cosmetic guard `function_exists('wp_ob_end_flush_all')` in the export streaming loop was always true (function exists in core). Replaced with `ob_get_level() > 0` which actually reflects whether output buffering is on.
**Bug**: `Update URI` plugin header now points at the product page so WP core stops querying WordPress.org for updates and lets the SDK handle them.
**DX**: `BDW_404BB_Public::ip_in_cidr()`, `BDW_404BB_Public::ip_matches_list()` and `BDW_404BB_Admin::csv_safe()` promoted to public static helpers so they can be unit-tested directly.
**DX**: `Network: false` declared explicitly in the plugin header so WP and ManageWP-style tooling treats it as a single-site product.
**Compat**: `Tested up to: 6.7`.
**Feature**: CIDR range support in whitelist and blocklist (e.g. `192.168.0.0/24`, `2001:db8::/32`). Essential to cover NAT-based office networks.
**Feature**: log retention policy with a daily WP-Cron task (`bdw_404bb_daily_cleanup`) that prunes rows older than the configured number of days (default 30, 0 = keep forever).

[B] 404 Bot Blocker