DevDome Bot Protection: Bot Blocker and AI Crawler Control

DevDome Bot Protection is a bot blocker that detects scanners, exploit probes and unwanted automated traffic. Review bot traffic and block bad bots with configurable detection rules, request rate limits and custom rules, without CAPTCHAs. Use Known Bots for crawler control, with separate choices for supported AI training, search and user-request agents. Block AI crawlers through WordPress's virtual robots.txt and HTTP blocking in Block Bad Bots mode. Google-Extended and Applebot-Extended use robots.txt controls only. Start in Record Bots to review detected requests before enabling HTTP blocking. Local protection needs no account. Detection uses local rules, with reference lists downloaded when Outside Lookups is enabled. Known Bots robots.txt directives, the enabled honeypot and browser session collection operate independently of the protection mode. Three modes

• Turned Off: disables the main protection engine.
• Record Bots: records detected bots without enforcing HTTP block actions.
• Block Bad Bots: blocks requests that match your blocking rules.

Known Bots robots.txt directives, the enabled honeypot and browser session collection operate independently of these modes. Five tabs

• Overview: choose your mode, review traffic totals and check sample crawler access. Mode changes save on click.
• Activity: review caught requests, bot and people totals, recent events, countries and technical details. Add an Allow This Visitor exception when IP anonymization is off.
• Rules: set actions for built-in detection, rate limits, repeat offenders, automated browsers, the honeypot and Bot Radar. Add custom rules for user agents, paths, IP addresses, ranges, countries or network numbers. Action changes save on click.
• Known Bots: control AI crawlers, search engines, SEO crawlers, social previews and uptime monitors. Each switch saves immediately. OpenAI and Anthropic training, search and user-request agents have separate controls.
• Settings: manage privacy, time zone, feeds, account connection, import/export, Clear Statistics and Cloudflare rules.

Use Recommended on Rules and Known Bots asks for confirmation. On Rules, it restores recommended actions while preserving thresholds and feature switches. Caught By Your Rules includes requests that would be blocked in Record Bots. Traffic totals count requests, not unique people. Detection and crawler controls Built-in rules cover scanner paths, scanner tools, Spamhaus DROP addresses, datacenter networks, empty user agents and automation tools. Additional controls cover login, XML-RPC and REST request rates, rapid page requests, repeat offenders and automated browser sessions. A first-party browser beacon records interaction signals. A hidden honeypot link helps identify crawling networks after multiple distinct IPs reach it. You can unflag networks or exempt them from future honeypot flagging. In the full engine, verified crawlers are exempt from automatic detection rules. Verification uses downloaded IP ranges or cached forward-confirmed reverse DNS. An explicit Known Bots block overrides that exemption. Custom Allow rules take precedence over the full engine's blocking rules. Blocked crawlers receive directives in WordPress's virtual robots.txt and HTTP blocking in Block Bad Bots mode. Google-Extended and Applebot-Extended are robots.txt controls only. Physical robots.txt files are not edited; Known Bots provides a downloadable snippet. Failed feed downloads keep previous lists. Unreadable event lists and counts are marked unavailable, with messages such as "could not be read" or unknown-value indicators instead of zero. Database failures also produce an error banner. Import/export transfers supported settings, Known Bots choices and custom rules as JSON. Import applies supplied settings and adds missing custom rules. Statistics, downloaded feeds and connection secrets are not transferred. Optional DevDome account Local protection works without an account. Connect through Settings or the shared DevDome hub to see this site's bot activity and settings in the DevDome dashboard. Settings are changed only in this plugin, by an administrator of the site; the dashboard cannot change them. Connected sites also send built-in rule actions, supported custom rules, time zone and daily traffic totals. External services below explains the exchange.

1.0.5

• A dismissible note at the top of the settings page mentions the free DevDome Analytics plugin, with a button that opens the plugin installer (or the Analytics screen when it is already active). Dismiss hides it for good.
• Shared DevDome library 1.7.13: uninstalling the last DevDome plugin also removes the note's dismissal, the update-repair records and the per-user "Report a bug" flag; the visitor-beacon flood guard keeps one short-lived record per address and clears its expired ones itself, and behind Cloudflare it counts per visitor instead of per Cloudflare address.
• Shared DevDome library 1.7.12: a Cloudflare visitor address header is trusted only when the connection itself comes from a Cloudflare address, so a forged header from anywhere else is ignored.
• Shared DevDome library 1.7.11: on a subdirectory multisite, a site mapped to its own domain is its own site and no longer shares the network's connection.
• The plugin now creates its tables and default settings on the next admin page load whenever they are missing, for example when the plugin files were copied into place or updated outside the plugin screen. Before, such a site showed the plugin as active while every request hit a failing database query and nothing was protected.
• The rate-limit and request-velocity counters keep one short-lived record per visitor address and clear their expired ones themselves. They used to write a new record per address every window, which sat in the database until the daily cleanup.
• Deleting the plugin also removes the cached update-check answer it kept in the database.

1.0.4

• The personal data exporter and eraser match exact addresses only. A row shortened by Anonymize IPs covers several visitors and is no longer included in one person's export.
• Database error texts shown on screen or sent with an error report also redact secrets and server paths.
• The Outside Lookups hint states that the good-bot check still uses this server's own DNS resolver.

1.0.3

• The plugin header now states Requires at least 6.2 and Requires PHP 7.4, so WordPress refuses to activate it on older versions (WordPress.org review).
• The reverse-DNS check for good bots answers "unverified" instead of failing on hosts where the DNS functions are disabled.

1.0.2

• The DevDome dashboard can no longer change anything on the site. Settings go one way, from the site to the dashboard; the remote sync endpoint and every remotely applied setting (mode, on or off, pause, rules, Known Bots, blocked countries, time zone) were removed.
• Shared DevDome library 1.7.10.

1.0.1

• Outside Lookups: one switch, off by default, for the bot list downloads and the country and network lookups. Nothing is contacted on activation.
• The early-block must-use file and the Safe Mode flag file are no longer written; Safe Mode is a setting.
• The Safety Link (a no-login pause URL) was removed.
• Events, sessions and reputation records are kept 90 days on every site.
• Chart.js 4.5.1.
• DevDome dashboard: paused, off or watching only are no longer listed as issues.
• Shared DevDome library 1.7.9: the DevDome dashboard lists only real problems (a feature that is off, paused or not connected is no longer an issue) and no longer says Not monitored.

1.0.0

• First public release.