Frenemy

No. Classification and reporting run on PHP's shutdown hook, after your page has been sent (and on most hosts, after the connection to the visitor is already closed). The classify step itself is local — no network calls in the request path, ever.

The plugin is deliberately observe-only — there is no blocking code in it at all, which is also why it can never break or slow your site. Deciding is what your Frenemy dashboard is for: you see exactly who visits, verified against operator-published IP ranges, and you can author per-bot rules that rehearse against your real traffic — each one showing precisely what it would have caught. Acting on a bot then becomes a decision you make on receipts, with guardrails that keep rules away from the search crawlers your SEO depends on.

Page caches and static files are served before WordPress (and therefore Frenemy) runs. Frenemy sees every request that reaches WordPress itself: cache misses, searches, POSTs, logins, REST and XML-RPC traffic — which is where bot activity concentrates. We state this honestly rather than estimate numbers we can't measure.

Per PHP-reaching request: the classification, method and path, status, duration, and the visitor IP (processed transiently on our side — hashed with a rotating salt, raw value never stored). The user-agent string is transmitted only for unrecognized bot-like requests, never for humans. Presumed-human traffic is sampled at a low rate; exact totals are kept via counters, not tracking. No cookies are set, no fingerprinting is done, and no visitor profile is built. See https://frenemy.dev/privacy.

Three ways, strongest first: define FRENEMY_DISABLED as true in wp-config.php (host-level), deactivate the plugin, or use the "Pause observation" toggle in Settings → Frenemy. Uninstalling removes every option the plugin created.

Not yet — single-site installs only in this version.