Installation Guide
6 steps from zero to fully protected. No server access needed.
Start here — download the plugin ZIP file
⬇️Download botwpshield.zipBotWPShield v3.5.0 · 20 KB · GPL2 License
Download the Plugin
Click the button below to download the BotWPShield plugin ZIP file (v3.5.0, ~20 KB).
⬇️ Download botwpshield.zipv3.5.0 · 20 KB · WordPress 5.0+ · PHP 7.4+
Install in WordPress
- aGo to your WordPress admin → Plugins → Add New
- bClick Upload Plugin at the top of the page
- cChoose the
botwpshield.zipfile you just downloaded - dClick Install Now, then Activate Plugin
Create Your Free Account
You need a free BotWPShield account to get your API key. The plugin uses this key to connect to our threat intelligence network.
Create Free Account →No credit card required. Free plan covers 1 site with all features.
Add Your Site & Copy API Key
- aLog into your BotWPShield Dashboard
- bClick Add Site and enter your WordPress site URL
- cCopy the API key shown on the site detail page (under the Setup tab)
Paste API Key in WordPress
- aIn WordPress admin go to Settings → BotWPShield
- bPaste your API key in the API Key field
- cClick Save & Apply — protection starts immediately
Optional: Telegram Alerts
- aMessage
@BotFatheron Telegram →/newbot→ copy the token - bMessage
@userinfobotto get your Chat ID - cPaste both in WordPress → Settings → BotWPShield → Telegram Alerts section
- dYou'll now receive instant attack alerts AND a weekly security report every Sunday at 8am
✅ What Activates Immediately
Once your API key is saved, these protections kick in automatically:
Auto-Hardening
Instantly adds security headers, blocks .env/.git/wp-config access, disables directory listing
Tor Blocklist
3,100+ Tor exit nodes start blocking within 5 minutes of first sync
IP Blocklist
Global threat intelligence + your site's blocks sync every 5 minutes
Vuln Scanner
Scans 25+ plugins on your next admin login and alerts you via Telegram if any are outdated
Subnet Detection
Coordinated /24 subnet attacks get auto-blocked after 3 IPs hit in 5 minutes
Tarpit
Medium-risk IPs get slowed down; high-risk get instant 403
🔧 Troubleshooting
Plugin shows "Offline" in the dashboard
Make sure your API key is correctly copied — no extra spaces. Then click Save & Apply again. Check that your server can make outbound HTTP requests to api.botwpshield.org.
Hardening says "Not applied"
Your .htaccess file may not be writable. In your hosting file manager, set the .htaccess file in your WordPress root to 644 permissions, then go to Settings → BotWPShield and save again.
No Telegram alerts arriving
Make sure you messaged your bot at least once in Telegram before entering the Chat ID — Telegram bots can't message users who haven't started a conversation first.
Geoblocking is not working
For non-Cloudflare sites, country detection is async — the first visit from a new IP is always allowed while the country lookup happens in the background. The block applies on the next visit from that IP.
Ready to protect your site?