Witen Blocker – Security, Firewall, Login Protection & AI Crawler Blocking

Witen Blocker is a security firewall for WordPress. It blocks attackers and known exploits, locks out bots guessing your password, adds two-factor sign-in, scans your files for malware, stops comment spam, and lets you choose which AI crawlers can read your content. Protection starts the moment you activate it, with no account and no setup wizard. Lock out password guessers Five failed logins in five minutes locks the address out for an hour, and you can change all three numbers. Slow guessing is caught too: twenty failures within an hour lock the address out for a day. Add two-factor sign-in with any authenticator app and printable recovery codes, so a stolen password alone no longer opens your dashboard. Move the login page to an address only you know. Witen keeps your login names from visitors who ask your site for them, and the sign-in screen never says whether a name is a real account. Block known WordPress exploits Template traversal and comment exploit requests are refused before they reach the vulnerable WordPress code. No account needed. Choose which AI crawlers read your site Every recognized crawler gets its own allow or block switch. Welcome every AI crawler, block them all, or pick one by one. Nothing is blocked until you choose. Witen Blocker recognizes GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Common Crawl, Meta-ExternalAgent, Amazonbot, and Applebot, plus the major search engines and ten uptime monitors, so a rule for one bot never catches the services you rely on. robots.txt states your preference; Witen Blocker enforces it. A crawler you block gets an HTTP 403. Crawlers are matched by their published network ranges as well as their user agent, so a scraper pretending to be Googlebot doesn't get Googlebot's pass. Stop comment spam without a spam service A hidden field and a timing check catch bots. No comment text ever leaves your site. Connected sites can also use a separate shared spammer list for comments. Repeated honeypot detections from different sensors and customer licenses can contribute addresses to this list. Timing checks and hits on the shared list do not contribute new shared reputation. Comments marked as spam remain in the Spam folder for review. This protection does not create login or site-wide blocks; you can turn it off in Witen > Settings. Catch unexpected file changes A daily scan checks WordPress core against the official checksums, flags new and changed files, and looks for known malware patterns. Nothing is deleted or changed without you. Connected sites also receive maintained malware catalogs. Block attackers before they reach you Connect a free Witen account and your site gets blocklists built from attacks seen across every Witen site and server. An address caught attacking other sites is blocked on yours before it tries. Requests are checked against a local copy of the list, so no page load waits on Witen. Connecting requires a Witen account and security-event sharing. Every local feature stays free, with no trial expiry. Free connected sites get a daily blocklist update. Paid plans add more sites and servers, other feed profiles, and off-site backup storage. Shared hosting or your own server On shared hosting, blocked requests get an HTTP 403 from WordPress, with no server access needed. On your own Linux server, add the Witen Warden agent and blocks move to the firewall, before the traffic ever reaches PHP. Get started: activate Witen Blocker and open Witen > Dashboard to see what's already on. Use Firewall > Bots and AI crawlers to choose which crawlers can visit, and Login to set up two-factor sign-in. Setup guide | Witen plans | Support

1. Open Plugins > Add New Plugin, search for Witen Blocker, and install and activate it. You can also upload the plugin ZIP.
2. Open Witen > Firewall and add your own IP address to the never-block list. Then choose which bots and AI crawlers to allow.
3. Open Witen > Login to set up two-factor sign-in for your account.
4. Optional: to add shared blocklists, create a Witen account, add your WordPress site from the dashboard, and enter its one-time setup token in Witen > Settings. Review the terms and privacy information before connecting. The first blocklist arrives after background maintenance runs.

See the setup guide to connect a local Warden agent or configure your site through wp-config.php.

0.6.56 What you will notice after upgrading

• A renamed login page stays hidden. Visiting /wp-admin/ without being signed in now answers "not found" instead of sending you to your login address, and so do /login, /admin, and /dashboard. Bookmark your login address. Adding ?witen_login=1 to your home page no longer opens the login.
• Your login names are kept from visitors. Asking your site for a user by number (yoursite/?author=1) or through the REST API now answers "not found" to anyone who is not signed in. The sign-in screen says "The username or password is incorrect" whether the name or the password was wrong, and the password-reset screen says "check your email" for any name, so a mistyped username there shows no error. Author pages stay unless you turn on "Also hide author pages" under Settings, Advanced.
• New screens. An activity log, linked from the dashboard, shows the blocks, sign-ins, scans, and setting changes Witen recorded, keeps 90 days, and can be emptied. The Firewall page lists the lockouts your site is holding, each with a Lift link.
• Signup spam is refused before the account exists, on by default, on the WordPress registration screen, multisite signup, and the WooCommerce account form. You choose how strict usernames are.
• Two-factor after a key change. If you change the security keys in wp-config.php, the sign-in screen now says authenticator codes need setting up again and asks for a recovery code, and administrators see a notice.
• Connected tools. With WordPress 6.9 or later, tools you connect as an administrator can read your protection status. They can change blocking only after you turn that on under Settings, Advanced.

Lockouts

• Slow password guessing is locked out. Trying one password every few minutes used to stay under the limit forever. Now 20 failed sign-ins from one address within an hour lock it out for a day. Someone who mistypes and then signs in stops counting, so people sharing an office address are not locked out by each other's typos. Failed application-password sign-ins now count too.
• Broken images, scripts, and links on your own pages no longer lock your visitors out, and one wrong password can no longer lock someone out during an attack on your login.
• IPv6 lockouts cover the visitor's whole /64 network, so changing address no longer escapes them.
• With Warden on the server, lockouts always happen, including for visitors behind a CDN, and Warden decides when they end: with Warden 0.1.48 or later, "sudo warden unban" ends the site's own lockout too, within about a minute.
• Unblocking an address from the Witen feed now lasts, and Witen refuses to block a CDN address your visitors share, your own connection, or an address you recently signed in from.

Your server files and your data

• The blocklist rules Witen writes to .htaccess can no longer open up a password-protected site, every .htaccess change is checked and undone if your site stops loading, and an off-site restore is written only when it matches a backup your own site uploaded.
• Witen no longer writes to the database on every page view of a site that is not connected, and connected sites no longer look up Witen's address while serving a visitor.
• Commenter names are no longer sent to Witen, a mistyped username on a failed sign-in is no longer stored, and deleting the plugin removes everything it stored.
• A paid site keeps its plan when Witen cannot be reached.

Every change is listed in changelog.txt in the download. 0.6.55

• Malware scans keep going when a folder or file can't be read, and keep every match they found. Before, one unreadable folder could stop the scan and lose its results.
• The Security Scan page lists the paths it couldn't check as scan warnings, apart from malware results. Warnings are never sent as malware samples.
• You can turn off Witen's comment spam protection in Settings, for example if Akismet or another plugin already filters your comments. It stays on by default. Turning it off removes the hidden comment-form fields and timing check, and stops the shared spammer list.
• Bundle Witen SDK 1.8.2.

0.6.54

• The server rules page no longer gives your site a letter grade, on purpose. The grade rewarded rules that switch features off, such as blocking XML-RPC, which breaks Jetpack and the WordPress mobile apps, and it dropped whenever we added a rule. It now shows how many recommended rules are on.
• Recommended rules have no real downside for a normal site. "Turn on recommended rules" replaces "Enable All" and never turns on an optional rule.
• Blocking XML-RPC and hiding the server signature are now optional rules, listed apart with what each one turns off. If you already block XML-RPC, it stays blocked. Most sites can leave XML-RPC on: login lockout already covers it, and WordPress checks only one password per XML-RPC request.
• New recommended rule: block the upgrade folder. WordPress 7.1.4 fixed an attack on wp-content/upgrade during updates; this rule refuses every web request into that folder. A one-time notice on Witen pages offers to turn it on.
• When your server lets WordPress load its own pages, every change to .htaccess now checks, past any cache, that your site still loads, and puts the file back if it does not. Where the check cannot run, Witen says so and tells you how to undo the change. On a host that does not allow a rule, the other recommended rules still turn on, and Witen names the one it left off.
• Changes that fail now say why, instead of reporting success.
• With Warden on the server, the login lockout settings now show the lockout Warden really enforces. If Warden allows a shorter lockout than the one you set, or counts failed sign-ins across your sites and locks an address out before your limit, the settings say so. Warden 0.1.41 enforces the lockout length you set, up to one day by default; older versions cut it to an hour, and the settings warn when that applies.
• Treat requests for PHP files inside wp-content/upgrade as webshell probes.
• Bundle Witen SDK 1.8.1.

0.6.53

• Turn on Vulnerability alerts in Settings to share your installed plugin and theme versions. Witen then lists the ones with known vulnerabilities, and the version that fixes each, on the Vulnerabilities page of your Witen dashboard. It is off until you turn it on, and only plugin and theme names and versions are sent.
• Turning Vulnerability alerts off deletes the shared list from Witen.
• Sites connected through a local Warden share the list through Warden 0.1.35 or later, only when package listing is turned on for the server too.
• Bundle Witen SDK 1.8.

0.6.52

• Check comments on connected sites against a separate shared spammer list. An address joins it only after honeypot detections from different customer licenses and sensors. Matching comments go to the Spam folder for review and never block pages or logins. Turn it off in Settings.
• Report why a stored comment was marked as spam: honeypot, timing, or the shared list. Comment text and email addresses are never sent.
• Never ban an unlisted reverse proxy on a private network. Failed logins through it are still recorded and counted. Trusted proxies now says plainly when a public address that sends forwarding headers can be banned.
• Record a correct password still waiting for its two-factor code in the audit log. It never counts as a failed login, never resets the failure count, and never lifts a ban.
• Count each failed login against the account it tried. Signing in clears only that account's failures, so a valid password for one account cannot reset the count against another. Failed logins recorded before the update keep counting.
• With a local Warden, show which blocks live in the server firewall. WordPress cannot lift those, so the blocklist no longer offers Unblock for them, and a new note gives the exact server command for each kind of block.
• Never ask a local Warden to lock out an allowlisted address after failed logins.
• Bundle Witen SDK 1.7. See changelog.txt in the download for older releases.