ddosNull Shield — DDoS & Bot Protection

Stop bots and DDoS attacks before they reach your WordPress site — without touching your DNS, hiring a developer, or slowing down your pages. ddosNull Shield silently monitors your WordPress traffic in the background. Only visitors identified as malicious are intercepted. Real customers never notice it's there. Up and Running in Under 60 Seconds No server access, no terminal, no config files.

1. Install the plugin from your WordPress admin
2. Click Connect to ddosNull and sign in (or create a free account)
3. Protection activates immediately

Why WordPress Stores Get Attacked Modern attackers don't try to flood your "pipe" anymore. They send requests that look exactly like real browsers — thousands of them — forcing your server to work 100x harder. Your pages slow down, customers abandon their carts, and your checkout stops processing. It's called a Layer 7 attack, and standard firewalls let them straight through. ddosNull's AI is specifically trained to spot these invisible patterns and stop them before they impact your store. What ddosNull Shield Protects You From DDoS & Bot Traffic The ddosNull cloud analyzes your traffic patterns continuously. Malicious IPs are pushed to your site automatically — blocked the moment they show up, with zero performance impact on normal page loads. All analysis runs on ddosNull's servers, not yours. Carding & Fake Order Bots (WooCommerce) — ddosNull Shield Pro Carding bots probe thousands of stolen credit cards on your checkout page in rapid card testing attacks, racking up chargeback fees and putting your payment gateway account at risk. Other bots flood your store with fake orders just to test stolen card numbers or scrape discount codes. ddosNull evaluates each checkout submission against multiple behavioral signals — and blocks bots before any order is ever created. Legitimate shoppers check out without any interruption. Checkout protection is available with ddosNull Shield Pro. Smart Challenges, Not Hard Blocks Not every suspicious request is an attack. Sometimes it's a real customer on a slow VPN. ddosNull uses a proof-of-work challenge (ALTCHA) that resolves silently in the background for most real visitors. Only confirmed bots are hard-blocked. Google reCAPTCHA v2 is also supported as an alternative. Zero Risk — Try It in Dry Run Mode Install ddosNull Shield and enable Dry Run Mode from your dashboard. Every request is scored, but 100% of traffic is allowed through. You'll see a detailed log of exactly which IPs would have been blocked — and why. When you're confident, activate protection with one click. Works Everywhere WordPress Works No DNS changes. No proxy. No re-routing your traffic through a third-party network. ddosNull Shield works directly inside WordPress at the PHP layer — compatible with any host, including WP Engine, Kinsta, SiteGround, shared cPanel and Plesk hosting, and Cloudflare. What Our Customers Say "DDoSNull saved us during our peak holiday sales season. We were hit by a massive Layer 7 attack and didn't even notice until we got the notification that it had been mitigated. It's set-and-forget protection. I sleep better at night." — Sarah J., CTO of an E-commerce Store "As a DevOps consultant, I recommend DDoSNull to all my clients running WordPress. The one-click setup is a dream, and it provides enterprise-grade protection without the enterprise-grade price tag or complexity. It just works." — Mike C., DevOps Consultant Features

• AI-driven Layer 7 DDoS protection with automatic IP blocking
• ALTCHA proof-of-work challenge (resolves silently for most real visitors)
• Google reCAPTCHA v2 support as an alternative challenge
• Checkout protection against carding, card testing, and fake orders for WooCommerce — ddosNull Shield Pro (premium)
• Hard-block mode for confirmed malicious IPs (403 response)
• IPv4 and IPv6 CIDR range support
• URL whitelisting with regex support
• User-agent blacklisting and whitelisting
• IP whitelisting
• Dry Run Mode for zero-risk evaluation
• Cloudflare compatible (reads CF-Connecting-IP header)
• Optional early loading for better performance (opt-in)
• Compatible with any WordPress host — no server access required

A free ddosNull account is required. Sign up and connect your site directly from the plugin settings page.

1.1.30

• Fix fatal error "Cannot redeclare function ddosnull_shield_next_9am()" when activating ddosNull Shield Pro while the free plugin is still active.

1.1.29

• Warn in the plugin dashboard when WP-Cron is disabled (DISABLE_WP_CRON), since the plugin relies on it to send load stats and scan results to the backend server.

1.1.27

• Increase timeout for the periodic load-stats backend request from 10 to 60 seconds to reduce false "backend unreachable" failures on slower connections.

1.1.26

• Block IPs reported in the fake_ua_ips list with a 403, even when their request presents a whitelisted user-agent string (this list is for IPs caught by the backend spoofing a whitelisted UA to evade blocking).

1.1.25

• Fix challenge redirect dropping query-string parameters when the destination URL contains unencoded ampersands (e.g. filter parameters). The full URL is now preserved through the challenge form using a hidden field populated from the raw query string.

1.1.24

• Remove WordPress.org directory assets (banners, icons, screenshots) from plugin zip; these are uploaded separately via SVN.
• Remove branding footer from 403 block page to comply with WordPress.org guidelines.
• Fix Early Loading (MU Plugin) state detection in Pro plugin reading wrong MU file name.

1.1.23

• WordPress.org submission: add icon, banner, and screenshot assets.
• Add == Pricing == section and money-back guarantee info to readme.
• Internationalize all user-facing strings in challenge and block pages with load_plugin_textdomain and generate .pot file.
• Add source reference comment to admin.js.
• Redirect to plugin dashboard on first activation.
• Expand External Services section: document data transmitted to each service and add Terms of Use / Privacy Policy links for all three external endpoints (ddosNull, Google reCAPTCHA, ipify).
• Split plugin into free (Layer-7 DDoS/bot protection) and Pro (adds WooCommerce checkout protection) tiers to comply with WordPress.org remote-feature-gating guidelines.

1.1.22

• Fix early loading toggle always showing as off: detect MU plugin state from file existence rather than the stored setting, which could be missing if the file was installed via a different code path.

1.1.21

• Add protected_urls support: URL patterns (nginx-style regex or plain prefix) that force visitors through the verification challenge unless their IP or user-agent is whitelisted.

1.1.20

• Fix fatal error on sites using early loading: new option-key constants were not defined in the MU plugin loader before intercept.php ran.
• Rebuild admin JS.

1.1.19

• Store ip_list, block_with_403, and whitelisted_ips in separate wp_options entries with a 24-hour object-cache layer; cache is invalidated on each update.
• Store ip_list as a PHP array instead of a newline-delimited string, removing per-request parsing overhead.
• Clear the dynamic block list and disable DDoS mode when the ddosNull backend is unreachable, preventing the ALTCHA challenge from looping indefinitely.

1.1.18

• Improved checkout fraud detection.

1.1.17

• WordPress coding standards: replace parse_url with wp_parse_url, fopen/fclose with WP_Filesystem, unlink with wp_delete_file, rmdir with WP_Filesystem.
• Sanitize and unslash all superglobal reads ($_SERVER, $_COOKIE, $_POST).
• Add nonce verification to altcha and reCAPTCHA challenge form submissions.
• Prefix global variables in uninstall.php and remove unprefixed helper variable in main plugin file.
• Update tested-up-to to WordPress 7.0; align plugin name across header and readme.

1.1.16

• Serve 403 block page from a bundled local template with no external CDN dependencies.
• Fix cron schedule recovery for existing installs affected by the identifier rename in 1.1.15.

1.1.15

• Vendor ALTCHA JS locally, removing cdn.jsdelivr.net dependency.
• Use local plugin icon in admin menu and challenge page instead of remote URL.
• Add GPL-2.0+ license header to plugin file.
• Prefix all identifiers (cookie, transient, cron schedule) to avoid conflicts with other plugins.
• Use WP Filesystem API for must-use plugin file installation.
• Add uninstall.php to clean up settings, transients, and log files on deletion.
• Add opt-in early loading via must-use plugin dropper (toggle in Settings).
• Add readme.txt for WordPress.org submission.

1.1.14

• Add hard block (403) support for blacklisted user agents.

1.1.13

• Revert block_with_403 ordering change from 1.1.12.

1.1.12

• Fix: hard-blocked IPs could bypass the block via whitelisted URLs.

1.1.11

• Checkout protection now gated on a server-signed flag to prevent client-side tampering.

1.1.10

• Add regex support for whitelisted URLs (prefix with ~ for case-sensitive, ~* for case-insensitive).

1.1.9

• Challenge and block pages now set no-cache headers to prevent caching plugins from storing them.

1.1.8

• Add optional early loading via must-use plugin (opt-in from settings).

1.1.7

• Admin: protection suspended banner with link to dashboard; stats hidden when account limit is reached.

1.1.6

• Full IPv4 and IPv6 CIDR range support for blocked and whitelisted IP lists.

1.1.4

• Add CIDR range support for IP lists.

1.1.3

• Log challenge page hits with HTTP 429 status for accurate scan analysis.

1.1.2

• Fix IP detection to read X-Real-IP header for nginx reverse proxy setups.

1.1.0

• Enable Shield protection by default on fresh installs.