Delonix Security Agent focuses on two things: catching scrapers that send realistic browser headers, and keeping real users and site processes untouched.
How it works:
- Silent verification: a ~3 KB deferred script solves a small SHA-256 proof-of-work in the background and receives a signed HttpOnly cookie. Visitors see nothing. Clients that do not run JavaScript (curl, python-requests, Scrapy and similar scrapers) are sent to an automatic check page after a few pages.
- Verified crawlers: Google, Bing, Apple and DuckDuckGo are verified against their published IP lists (refreshed weekly). Other crawlers use capped reverse DNS. A fake "Googlebot" is challenged.
- AI and other bots: AI crawlers such as GPTBot, ChatGPT-User, PerplexityBot and ClaudeBot are allowed by default so AI assistants can cite the site. Claims are checked against published IP lists where they exist. SEO tools and link-preview bots (Telegram, WhatsApp and others) each have their own on/off switch. Bots whose IP cannot be verified get a per-IP rate budget.
- Flood protection: a hard per-IP request budget (429) for clients without a verification cookie. Verified visitors on carrier-grade NAT are never affected.
- Spam: guest comments and Contact Form 7 submissions are accepted only from verified browsers. Failed logins on wp-login.php and XML-RPC are limited per IP. XML-RPC can optionally be disabled.
- Cache safety: challenge and block responses are never cached (DONOTCACHEPAGE plus LiteSpeed no-cache). The verification script is excluded from WP Rocket and LiteSpeed JS optimizations. An optional WP Rocket mandatory cookie serves cached pages only to verified browsers.
- Low overhead: counters use a persistent object cache or APCu when available. Otherwise they use one atomic SQL statement, and transients are no longer used. Tokens are stateless HMAC. Logs are throttled per client. The gate runs while plugins load, before the theme.
- Never touched: REST API, admin-ajax, wc-ajax, WooCommerce wc-api payment callbacks, feeds, sitemaps, robots.txt, cron and admin. Custom paths and User-Agents can be excluded.
- Logged-in users are skipped by default; "Check logged-in users" applies the same checks to them.
- Also included: Google Ads click-marker awareness (gclid/gbraid/wbraid), IP/CIDR allow and block lists, trusted proxy support, evidence logging and CSV export.
Limitations: a WordPress plugin only sees requests that reach PHP. Large volumetric DDoS attacks need edge protection (a CDN or WAF). Pages served straight from disk by WP Super Cache (expert mode) or W3TC (disk enhanced) bypass PHP, so they cannot be checked. Headless browsers that run JavaScript can pass proof-of-work. Use the rate limits against them.
All features described here are included in this plugin, with no account or license. A separate Pro add-on with additional features is sold on
delonix.biz; it is not hosted on
WordPress.org, and this plugin works fully without it.