{"id":142,"date":"2026-02-27T18:47:50","date_gmt":"2026-02-27T17:47:50","guid":{"rendered":"https:\/\/baqueiro.es\/store\/?post_type=baqueiro_plugin&#038;p=142"},"modified":"2026-07-03T21:08:55","modified_gmt":"2026-07-03T19:08:55","slug":"b-404-bot-blocker","status":"publish","type":"baqueiro_plugin","link":"https:\/\/baqueiro.es\/store\/plugins\/b-404-bot-blocker\/","title":{"rendered":"[B] 404 Bot Blocker"},"content":{"rendered":"<h2>Your 404 log is a crime scene. Most plugins ignore it.<\/h2>\n<p>Every WordPress site on the public internet gets hit, every single day, by a swarm of automated scanners hunting for forgotten backup files, leaked credentials and known-CVE attack surfaces. They probe paths like <code>\/wp-config.php.bak<\/code>, <code>\/.env<\/code>, <code>\/admin.rar<\/code>, <code>\/wp-content\/uploads\/db.sql<\/code> \u2014 and the second one of those returns a 200, your site is owned.<\/p>\n<p>Your generic security plugin doesn&#8217;t see it. Your CDN doesn&#8217;t care. Your WAF only flags the obvious. Meanwhile, the bots cycle through millions of paths until something sticks \u2014 and you find out three days later, when Google blacklists your domain.<\/p>\n<h2>[B] 404 Bot Blocker fixes that \u2014 surgically.<\/h2>\n<p>It&#8217;s a focused, enterprise-grade firewall built around a single insight: <strong>real visitors don&#8217;t generate 30 404s in 60 seconds. Bots do.<\/strong> When an IP crosses the threshold you configure, it&#8217;s banned at the WordPress bootstrap layer (before any heavy code runs), with a 403 served on every subsequent request \u2014 including <code>wp-login.php<\/code>.<\/p>\n<h3>What makes it different<\/h3>\n<ul>\n<li><strong>Zero false positives for SEO.<\/strong> Googlebot, Bingbot, AhrefsBot and friends are explicitly allow-listed. Their crawls never count.<\/li>\n<li><strong>Headless detection that doesn&#8217;t break headless WordPress.<\/strong> We catch <code>HeadlessChrome<\/code>, <code>Selenium<\/code>, <code>Puppeteer<\/code>, <code>sqlmap<\/code>, <code>nikto<\/code> and 30+ scanner signatures \u2014 without blocking your own staging tools.<\/li>\n<li><strong>CIDR ranges in whitelist and blocklist.<\/strong> Add <code>192.168.0.0\/24<\/code> for the office network, <code>2001:db8::\/32<\/code> for an IPv6 transit, done.<\/li>\n<li><strong>Cloudflare \/ reverse-proxy aware.<\/strong> Honours <code>CF-Connecting-IP<\/code> and <code>X-Forwarded-For<\/code> when you opt in \u2014 and screams in the admin UI when proxy headers are detected but trust is off (a silent misconfiguration that makes most WP firewalls useless).<\/li>\n<li><strong>Audit log with WP-Cron retention.<\/strong> Every blocked request is logged with IP, URL, User-Agent and timestamp. Daily cron prunes rows past your retention window. Streamed CSV\/TXT export with formula-injection protection.<\/li>\n<li><strong>Manual block manager.<\/strong> One-click unblock, promote a temporary ban to permanent, or whitelist instantly \u2014 all from a dedicated tab.<\/li>\n<li><strong>GDPR &amp; LGPD compliant out of the box.<\/strong> Suggested privacy text, data exporter and eraser plug straight into <strong>Tools \u2192 Export \/ Erase Personal Data<\/strong>.<\/li>\n<li><strong>Self-lockout protection.<\/strong> Server-side guard refuses to ban your own IP. Admins are excluded from the 404 counter. You will never lock yourself out.<\/li>\n<\/ul>\n<h3>What it is <em>not<\/em><\/h3>\n<p>It&#8217;s not a 50-MB Swiss-army-knife security plugin with malware scanners, two-factor, login captchas and a cluttered dashboard. It does <em>one<\/em> thing \u2014 stopping bots that abuse 404s \u2014 and it does that better than anything else on the market. Use it standalone, or layer it under Wordfence\/iThemes for an extra perimeter that doesn&#8217;t overlap.<\/p>\n<h3>Built for production<\/h3>\n<ul>\n<li>~280 KB on disk. <strong>27 files.<\/strong> No Composer dependencies at runtime.<\/li>\n<li><strong>52 PHPUnit tests, 100% passing<\/strong> \u2014 we ship the test suite in our repo.<\/li>\n<li>Translated into 4 languages: English, Spanish (Castilian), Brazilian Portuguese, Galician. POT included.<\/li>\n<li>WPCS-compliant code, full PHPDoc, every function nonce-guarded and capability-checked.<\/li>\n<li>Update delivery via the [B] License Manager \u2014 no WordPress.org dependency, no public exposure.<\/li>\n<\/ul>\n<p><strong>The firewall <em>never<\/em> stops working when your license lapses.<\/strong> A security plugin that disables itself on payment failure is malpractice. Yours keeps protecting; only the update channel goes silent.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Stop the silent bot army probing your WordPress site. Auto-blocks scanners that hammer your 404s looking for `\/wp-config.php.bak`, `\/.env`, `\/admin.rar` and 1,000 other shells.<\/p>\n","protected":false},"featured_media":145,"template":"","plugin_category":[148,149,59,58],"use_case":[75,78,150,60,130],"license_type":[71,151],"compatibility":[61,45,156,153,155,154,56,152,81,82],"class_list":["post-142","baqueiro_plugin","type-baqueiro_plugin","status-publish","has-post-thumbnail","hentry","plugin_category-anti-bot","plugin_category-audit-logs","plugin_category-firewall","plugin_category-security","use_case-agencies","use_case-e-commerce","use_case-headless-decoupled","use_case-membership","use_case-publishers","license_type-commercial","license_type-gpl-v2-or-later-code","compatibility-cloudflare","compatibility-elementor","compatibility-headless-wp-wpgraphql","compatibility-ithemes-security","compatibility-litespeed-cache","compatibility-polylang","compatibility-woocommerce","compatibility-wordfence","compatibility-wp-multisite","compatibility-wpml"],"_links":{"self":[{"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/baqueiro_plugin\/142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/baqueiro_plugin"}],"about":[{"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/types\/baqueiro_plugin"}],"version-history":[{"count":7,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/baqueiro_plugin\/142\/revisions"}],"predecessor-version":[{"id":388,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/baqueiro_plugin\/142\/revisions\/388"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/media\/145"}],"wp:attachment":[{"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/media?parent=142"}],"wp:term":[{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/plugin_category?post=142"},{"taxonomy":"use_case","embeddable":true,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/use_case?post=142"},{"taxonomy":"license_type","embeddable":true,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/license_type?post=142"},{"taxonomy":"compatibility","embeddable":true,"href":"https:\/\/baqueiro.es\/store\/wp-json\/wp\/v2\/compatibility?post=142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}