Title: Bot Storm Radar Author: Rafael Minuesa Published: 12. okt 2026 Last modified: 12. okt 2026 --- Search plugins ![](https://ps.w.org/bot-storm-radar/assets/banner-772x250.png?rev=3741154) ![](https://ps.w.org/bot-storm-radar/assets/icon.svg?rev=3741154) # Bot Storm Radar By [Rafael Minuesa](https://profiles.wordpress.org/rafaelminuesa/) [Download](https://downloads.wordpress.org/plugin/bot-storm-radar.0.5.0.zip) * [Details](https://et.wordpress.org/plugins/bot-storm-radar/#description) * [Reviews](https://et.wordpress.org/plugins/bot-storm-radar/#reviews) * [Installation](https://et.wordpress.org/plugins/bot-storm-radar/#installation) * [Development](https://et.wordpress.org/plugins/bot-storm-radar/#developers) [Support](https://wordpress.org/support/plugin/bot-storm-radar/) ## Description Bot attacks no longer come from one address. They come as swarms of thousands of addresses that each make one or two requests, so a tool that judges visitors one by one sees nothing wrong. Bot Storm Radar watches the crowd instead. Every minute it counts how many different addresses visited, how many made only one request, how many loaded a stylesheet or a script the way a real browser does, and how evenly the browser names are spread. It turns that into a storm score, learns what normal traffic looks like on your site, and tells you in plain words whether a bot storm is running right now and why. It also protects. It refuses requests for files only scanners ask for before WordPress builds a page, and a single address that keeps probing or asking for missing pages can be banned for a while. Address bans start in observe mode, where they are listed and nobody is refused, until you switch them on. **The radar** * **Swarm metrics every minute.** Single-hit ratio, asset ratio, user-agent evenness, error pressure and endpoint concentration, combined into one storm score and gated by traffic volume. * **Learned baseline.** Over the first seven days the plugin learns the site’s normal number of distinct addresses per minute and its normal asset ratio, and shows them beside each threshold. * **Storm states.** Calm, warning, storm and cooling. Every transition is logged with the numbers that caused it and an explanation in words. * **Alerts** by plain-text email on warning, storm and all-clear. * **Good-bot verification.** DuckDuckBot is verified against its published address list. Googlebot, Bingbot, Applebot and Yandex are verified by reverse DNS plus forward confirmation once you switch on the Search bot check; until then their claims are counted as not checked and never banned. A user agent alone proves nothing. * **The real visitor address behind a proxy.** A forwarding header is believed only when the request arrived through Cloudflare, a local proxy or a proxy you declare. A spoofed `X-Forwarded-For` from an ordinary client is ignored. * **Radar screen** with the current state, the last 24 hours per minute, top classes, top keys, bot claims and the storm timeline, plus a dashboard widget. The radar observes and reports. It never blocks a swarm. On a quiet site the numbers stay near zero and the state stays calm. **The protection** * **Refused early.** The refusal runs as soon as WordPress has loaded its plugins, before the theme, the query or any page is built, and reads its rules from one stored option without an extra database query. * **Probe refusal**, on by default. A 403 for `.env` and other dot-files, copies of PHP files, configuration and log files, backups and dumps, other applications’ admin paths and `.php` files that do not exist. Files your web server serves itself never reach it. * **Address bans**, observe mode first. An address that sends 3 probes in 10 minutes or asks for 20 missing pages in a minute is banned for an hour, and for a day on a repeat. Administrators (for a day after they last used wp-admin), verified search bots, Cloudflare and declared proxies and a never-ban list are never banned. * **Bans tab** with every ban, its evidence and an Unban button, the bans that would have happened in observe mode, and search-bot claims waiting for verification. * **A dry run over your own logs.** `wp bot-storm-radar replay --gate` shows what would have been refused in your access logs before you switch bans on. **Also** * Reads web-server access logs (nginx or Apache combined format) as separate sources from WP-CLI, for traffic that never reaches WordPress. * WooCommerce request classes (cart, checkout, wc-ajax) when WooCommerce is active. * Counters live in the persistent object cache or in APCu, with a transient fallback. One of the first two is strongly recommended. ### External services The plugin ships with two public address lists and uses them as they are. It makes no HTTP request to an outside service unless you ask it to: switch on **Address lists** on the Settings tab to download both lists once a day from WordPress cron, or click **Download address lists now**. A download sends nothing about your visitors. Like any HTTP request, it shows the service your server’s IP address and a user agent. * **Cloudflare address ranges**, from `https://www.cloudflare.com/ips-v4` and ` https://www.cloudflare.com/ips-v6`. The plugin needs them to tell a request that really came through Cloudflare from one that only claims to. The request carries the WordPress default user agent, which names your site’s address. The bundled copy is used until the first download and whenever a download fails. The service is provided by Cloudflare, see its [terms](https://www.cloudflare.com/website-terms/) and [privacy policy](https://www.cloudflare.com/privacypolicy/). * **DuckDuckBot address list**, from `https://duckduckgo.com/duckduckbot.json`. The plugin needs it to verify visitors that claim to be DuckDuckBot. The request carries the user agent `BotStormRadar/` followed by the plugin version. The bundled copy is used until the first download and whenever a download fails. The service is provided by DuckDuckGo, see its [terms](https://duckduckgo.com/terms) and [privacy policy](https://duckduckgo.com/privacy). The DNS check of search bots is off by default as well. Switch on **Search bot check** on the Settings tab to verify visitors that claim to be Googlebot, Bingbot, Applebot or Yandex: the plugin then asks your server’s own DNS resolver for the host name of such an address, and looks that host name up to confirm it points back to the same address. Whether your resolver answers from its cache or asks other DNS servers, which then see the address, depends on your server’s configuration. With the check off, no lookup is made and those visitors are never banned. The same lookups run once when you ask for them on the command line with `wp bot-storm-radar replay -- gate --verify-bots`. The plugin has no telemetry service. ## Screenshots [⌊The Radar tab during a storm, with the current state, the score of the last minute, the learned baseline and the last 24 hours.⌉⌊The Radar tab during a storm, with the current state, the score of the last minute, the learned baseline and the last 24 hours.⌉[ The Radar tab during a storm, with the current state, the score of the last minute, the learned baseline and the last 24 hours. [⌊The storm timeline. Every transition is listed with the numbers that caused it, in words.⌉⌊The storm timeline. Every transition is listed with the numbers that caused it, in words.⌉[ The storm timeline. Every transition is listed with the numbers that caused it, in words. [⌊Request classes, the busiest networks and user agents, and search-bot claims with their verification.⌉⌊Request classes, the busiest networks and user agents, and search-bot claims with their verification.⌉[ Request classes, the busiest networks and user agents, and search-bot claims with their verification. [⌊The Bans tab, with each ban's evidence and an Unban button, the bans that would have happened in observe mode, and claims waiting for a search-bot check.⌉⌊The Bans tab, with each ban's evidence and an Unban button, the bans that would have happened in observe mode, and claims waiting for a search-bot check.⌉[ The Bans tab, with each ban’s evidence and an Unban button, the bans that would have happened in observe mode, and claims waiting for a search-bot check. [⌊The settings for address bans and probe refusal.⌉⌊The settings for address bans and probe refusal.⌉[ The settings for address bans and probe refusal. [⌊The dashboard widget.⌉⌊The dashboard widget.⌉[ The dashboard widget. ## Installation 1. Upload the `bot-storm-radar` folder to `/wp-content/plugins/`, or install the plugin from the Plugins screen. 2. Activate it. 3. Open **Bot Storm Radar** in wp-admin. Leave it running for a week so the baseline can learn, then review the thresholds on the Settings tab. 4. Before you switch address bans to enforce, look at the Bans tab after a few days, or replay your access logs with `wp bot-storm-radar replay --gate`. ## FAQ ### Does it block a bot swarm? Not yet. The radar detects a swarm and tells you. What the plugin refuses today are scanner probes, for every visitor, and single addresses that tripped a ban once you switched bans to enforce. ### What is observe mode? Address bans start in observe mode. An address that would have been banned is listed on the Bans tab with the requests that caused it, and nobody is refused. When the list looks right, switch to enforce on the Settings tab. ### Can it lock me or a search engine out? Administrators, for a day after they last used wp-admin, verified search bots, Cloudflare and declared proxies, and the addresses on your never-ban list are never banned. Put your own address on the never-ban list if you may stay away from wp-admin longer. An address that claims to be a search bot is verified before anything happens to it; while the Search bot check is off, an address claiming to be Googlebot, Bingbot, Applebot or Yandex is never banned. ### How do I switch the refusals off without wp-admin? Rename or delete the `bot-storm-radar` folder in `wp-content/plugins/` by SFTP or in your host’s file manager. WordPress then stops loading the plugin, and nothing is refused. ### Does it work behind Cloudflare or another proxy? Yes. Cloudflare is recognized by its published address ranges. Another proxy has to be declared on the Settings tab, and the plugin tells you when it sees one that is not declared. ### Does it need an object cache? No, but a persistent object cache (Redis, Memcached) or APCu is strongly recommended. Without one the counters fall back to transients in the database, and the Radar screen warns about it. ### Does it write files? No. Settings, bans, minute history and the refusal rules are stored in the database. ### Does it track visitors? No. It sets no cookies and has no telemetry, so nothing about your visitors is sent to the plugin’s author or any other service. The only lookups that involve a visitor’s address are the DNS checks of visitors that claim to be search bots, which run only if you switch them on (see External services). To tell real browsers from bots, every front-end page asks your own site for a 1-pixel image and runs one line of JavaScript that requests it once more; both requests only add to the counts of the current minute. Visitor addresses are kept only as long as the detection needs them: per-minute counters expire after 25 minutes, and the minute history of the last 25 hours keeps totals plus the busiest addresses of each minute (at most 20, each with 10 or more requests in that minute). An address that tripped a ban is stored with the requests that caused it (paths and user agent) until 30 days after its ban ended, the list of would-be bans keeps the latest 200 addresses, an address claiming to be a search bot waits at most a day for its check, and the addresses banned in the last hour are kept for the digest mail until the next ban replaces them. Administrator addresses are remembered for a day so they are never banned, search-bot checks for a day, and a suspected proxy address until you trust or dismiss it. Uninstalling the plugin deletes all of it. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Bot Storm Radar” is open source software. The following people have contributed to this plugin. Contributors * [ Rafael Minuesa ](https://profiles.wordpress.org/rafaelminuesa/) [Translate “Bot Storm Radar” into your language.](https://translate.wordpress.org/projects/wp-plugins/bot-storm-radar) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/bot-storm-radar/), check out the [SVN repository](https://plugins.svn.wordpress.org/bot-storm-radar/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/bot-storm-radar/) by [RSS](https://plugins.trac.wordpress.org/log/bot-storm-radar/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.5.0 * The DNS check of visitors that claim to be Googlebot, Bingbot, Applebot or Yandex runs only when you switch on Search bot check on the Settings tab. Off by default; with it off, those visitors are never banned. * The admin-ajax, login, XML-RPC, comment and cron paths are taken from WordPress, so a moved admin or login page is recognized. #### 0.4.0 * Probes and banned addresses are refused inside the plugin, before a page is built. The plugin writes no files. * The Cloudflare and DuckDuckBot address lists are downloaded only when you switch on Address lists on the Settings tab. Off by default. * Every request value the plugin reads is sanitized where it is read. * The beacon script and the admin styles are enqueued. The full history is in [CHANGELOG.md](https://github.com/ProWoos-Devs/bot-storm-radar/blob/main/CHANGELOG.md). ## Meta * Version **0.5.0** * Last updated **13 tundi ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/bot-storm-radar/) * Tags * [bot protection](https://et.wordpress.org/plugins/tags/bot-protection/)[bots](https://et.wordpress.org/plugins/tags/bots/) [firewall](https://et.wordpress.org/plugins/tags/firewall/)[monitoring](https://et.wordpress.org/plugins/tags/monitoring/) [security](https://et.wordpress.org/plugins/tags/security/) * [Advanced View](https://et.wordpress.org/plugins/bot-storm-radar/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/bot-storm-radar/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/bot-storm-radar/reviews/) ## Contributors * [ Rafael Minuesa ](https://profiles.wordpress.org/rafaelminuesa/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/bot-storm-radar/)