ddosNull Shield — DDoS & Bot Protection

No. The plugin intercepts requests before WordPress loads the full page, and all traffic analysis happens on ddosNull's servers — not yours. There is zero performance impact on normal page loads.

No DNS changes, no proxy, no re-routing your traffic. ddosNull Shield works directly inside WordPress. Your DNS, CDN, and existing Cloudflare setup stay exactly as they are.

Use Dry Run Mode first. You'll see a report of exactly who would have been blocked before any blocking occurs. ddosNull also uses smart challenges (not hard blocks) for suspicious-but-not-confirmed traffic, so edge cases like VPN users get a quick verification step instead of a flat rejection.

Yes. Because ddosNull Shield works at the PHP/WordPress layer, it runs on any host that supports WordPress plugins — including shared cPanel and Plesk hosting. No server-level access is required.

Your WordPress site keeps running normally. The plugin stores the last known block list locally and continues enforcing those rules if the ddosNull cloud is temporarily unreachable. Nothing breaks.

Checkout protection against carding, card testing, and fake orders is available with ddosNull Shield Pro, distributed from ddosnull.com. When active, it collects lightweight browser signals on the checkout page — things like screen dimensions, JavaScript environment, and session timing. Orders that arrive too fast, without a real browser, or from known automation tools are blocked before the order is created. Legitimate shoppers experience no friction.

ALTCHA is a privacy-friendly proof-of-work challenge that runs silently in the browser. Most real visitors pass it automatically without clicking anything. It requires no Google account and collects no personal data.

Yes. Switch the challenge type to reCAPTCHA v2 in the plugin settings and enter your site key and secret key from Google.

Turning on "Optimize ddosNull" lets you choose how early the plugin intercepts a request, for better performance under heavy traffic. "MU Plugin" installs a small must-use plugin file so the check runs before regular plugins load, but after WordPress core itself has booted. "Auto-Prepend" goes further and intercepts before WordPress loads at all — including serving the verification/challenge page — by adding an auto_prepend_file entry to .user.ini or .htaccess; it requires PHP-FPM, CGI/LiteSpeed, or Apache mod_php with a writable .htaccess/.user.ini. Both are opt-in and can be changed at any time from the plugin settings page.

Yes. All paid plans include a 30-day money-back guarantee — no questions asked. You can also start on the Free plan (15,000 requests/month) before upgrading. There are no long-term contracts; you can cancel at any time and protection remains active through the end of your current billing period.

Your traffic never passes through ddosNull's servers. The plugin only shares anonymized metadata — IP addresses, request counts, and access log lines — to power threat detection. ddosNull never sees your customers' personal data, payment information, or page content.