The WordPress Security
Nobody Else Offers
Auto-hardening, shared threat intelligence, Tor blocklist, subnet auto-block, vulnerability scanning, geoblocking — all in one WordPress plugin. The only plugin with a live OWASP Top 10:2025 security score.
v3.5.0 · 20 KB · Works with WordPress 5.0+ · PHP 7.4+·Installation guide ↗
5 Stacked Protection Layers
Every active layer stacks on top of the others — attacks stopped at the earliest possible point
Stops attacks before your server sees them
Server-level block before PHP loads
Auto-written deny rules for nginx
plugins_loaded hook — priority 1
30 req/min, auto-ban at 50
12 Features Competitors Don't Have
Built for serious site owners and agencies. Not a basic firewall — a complete autonomous security layer.
Shared Threat Intelligence
Every attack reported by any site in our network is scored and shared globally. When one site blocks a bot, all sites are instantly protected.
Tor Exit Node Blocklist
3,100+ Tor exit nodes auto-blocked and refreshed every 6 hours from the official Tor Project. Zero configuration.
Subnet / CIDR Auto-Block
When 3+ unique IPs from the same /24 subnet attack within 5 minutes, the entire subnet is automatically blocked. Stop coordinated campaigns cold.
Cross-Site Instant Sync
Block an IP on one site — every other site in your account is protected within seconds. Perfect for agencies managing multiple clients.
Auto-Hardening (.htaccess)
On activation, automatically adds security headers, blocks sensitive file access (.env, .git, wp-config), disables directory listing, and locks PHP execution in uploads.
XML-RPC Auto-Disable
After 5 XML-RPC attacks in 10 minutes, BotWPShield automatically appends a deny rule to .htaccess. No manual action needed — ever.
Country Geoblocking
Block entire countries with one click. Cloudflare users get instant edge-level blocking. Others get cached IP-to-country lookups — no MaxMind license required.
Progressive Tarpit
Medium-risk IPs (score 40–70) get 0.5–1.5s random delays to waste scanner time. After 10 hits, they're fully blocked. High-risk IPs get instant 403.
Vulnerability Scanner
Scans 25+ popular plugins (Contact Form 7, Elementor, WooCommerce, Yoast, etc.) against known vulnerable versions on every admin login. Telegram alert if outdated.
Cloudflare Edge Sync
Connect your Cloudflare Zone ID and API token — blocked IPs are pushed to Cloudflare Access Rules so attacks are stopped before they even reach your server.
Weekly Telegram Reports
Every Sunday at 8am, get a full security report: total attacks, top countries, attack types, new blocks, Tor node hits, and any vulnerable plugins detected.
OWASP 2025 Security Score
Live 100-point security score computed against all OWASP Top 10:2025 categories. See exactly what's failing and get a step-by-step fix guide — updated every 5 minutes.
OWASP Top 10:2025
Built In, Not Bolted On
OWASP Top 10 is the global industry standard for web security — used by banks, governments, and Fortune 500s. BotWPShield is the only WordPress plugin that measures your site against every category and gives you a live 100-point score updated every 5 minutes.
Example score — yours updates every 5 min
Your site gets a live security report card
Every 5 minutes, BotWPShield's plugin sends a heartbeat to our API. We run 16 checks across all OWASP Top 10:2025 categories — REST API exposure, username leaks, misconfigurations, file integrity, authentication strength, and more.
Broken Access Control
FullBlocks REST API user enumeration, blocks ?author= username leaks, country-level access control via geoblocking.
Security Misconfiguration
FullAuto-hardening removes debug exposure, directory listing, wp-config web access, Server/X-Powered-By headers, PHP error display.
Software Supply Chain Failures
FullVulnerability scanner monitors 25+ plugins for outdated versions. Instant Telegram alert when a dangerous version is detected.
Cryptographic Failures
PartialSecurity score penalises non-HTTPS sites. HTTPS enforcement and debug.log exposure tracked on every heartbeat.
Injection
PartialBlocks script injection via query strings in .htaccess. Shared threat intel flags IPs associated with SQLi/XSS campaigns.
Insecure Design
N/ADesign-level concern for plugin/theme developers. BotWPShield provides runtime detection when insecure designs are exploited.
Authentication Failures
FullCustom login URL, honeypot trap, magic login links, failed login tracking, credential stuffing detection, Telegram brute-force alerts.
Software & Data Integrity
FullFile integrity monitor detects modified/missing core files. PHP shell detection in uploads with instant Telegram web shell alert.
Security Logging & Alerting
FullAll attacks logged. Real-time Telegram alerts for brute force, web shells, vulnerable plugins, and site downtime. Weekly reports.
Mishandling of Exceptions
PartialRate limiting and progressive tarpit handle anomalous traffic volumes. PHP errors are suppressed and never leaked to visitors.
7 of 10 OWASP categories fully covered.·3 of 10 partially covered.·No other WordPress security plugin comes close.
Get My OWASP Score Free →How We Compare
Features that no other WordPress security plugin provides out of the box
Up and Running in 3 Steps
No server access needed. No configuration files. Just install and protect.
Install Plugin
Download from your BotWPShield dashboard and install like any WordPress plugin. Takes 60 seconds.
Paste API Key
Copy your API key from the dashboard and paste it in WordPress → Settings → BotWPShield. Done.
Get OWASP Score
Within 5 minutes, your live OWASP 2025 score appears. Each failing check shows exactly how to fix it.
Fully Autonomous — Zero Babysitting
BotWPShield acts while you sleep. Here's what happens automatically:
Simple, Honest Pricing
All plans include every feature including OWASP 2025 scoring — no features locked behind higher tiers
Starter
1 site
- ✅ All 12 protection features
- ✅ OWASP Top 10:2025 live score
- ✅ Shared threat intelligence
- ✅ Tor blocklist (3,100+ IPs)
- ✅ Auto-hardening
- ✅ Geoblocking
Pro
Up to 5 sites
- ✅ Everything in Starter
- ✅ Telegram alerts + weekly report
- ✅ Cross-site instant sync
- ✅ Subnet auto-block campaigns
- ✅ Cloudflare edge sync
- ✅ Vulnerability scanner alerts
Agency
Unlimited sites
- ✅ Everything in Pro
- ✅ Unlimited sites
- ✅ White-label plugin
- ✅ Priority support
- ✅ Bulk site management
- ✅ API access
Your WordPress site is being scanned right now.
Bots probe WordPress sites thousands of times per day. BotWPShield detects them, slows them down, blocks them — and gives you an OWASP 2025 score to prove it.
No credit card. No server access required. Installs in 2 minutes.
View installation guide →