Everything in this article is optional. The defaults are a good fit for most websites. For the basics, see Getting Started with Bot Protection.
How it works
When a visitor looks suspicious, their browser is given a small math puzzle (a "proof of work") to solve before the page loads. A normal browser solves it automatically in the background. Most bots cannot run the JavaScript needed to solve it, and bots that can have to spend real computing time on every attempt, which makes attacking your site expensive. Visitors whose browsers look normal get an easier puzzle; clients that do not look like real browsers get a harder one.
If your site already had a security plugin that runs before every page (Wordfence, for example), Bot Protection is placed in front of it and the original keeps working. Switching Bot Protection off puts everything back the way it was.
The tabs at a glance
| Tab | What it's for |
|---|---|
| Overview | Mode (Protect / Observe / Off), general settings and removing Bot Protection. |
| Sites | On/off per site, which CAPTCHA each site uses, and IP validation. |
| URLs | Pages that should never be challenged, and pages that should be blocked. |
| Bots | Known bots and crawlers, each set to Allow, Challenge or Block. You can add your own. |
| IPs | Allow, challenge or block single addresses, ranges or networks (IPv4 and IPv6). |
| Activity | Recent challenged, passed and blocked requests, top bots, top addresses and most requested URLs, with one-click Block / Allow suggestions. |
| CAPTCHA | Optional Cloudflare Turnstile, Google reCAPTCHA or hCaptcha instead of the puzzle. |
| Automatic Protection | Whether we may switch Bot Protection on for you during an attack. |
Settings (Overview tab)
- Challenge difficulty - 1 (Light) to 5 (Very strong). "3 - Standard" is recommended. Each step makes the puzzle about 16 times harder; higher settings stop more bots but the "Verifying" page takes longer on slow phones.
- Blocked URL action - what happens to addresses on the URLs tab's "Block these URLs" list: refuse them with a 403 Forbidden error, or force a harder puzzle.
- Keep a log - records challenged, passed and blocked requests for the Activity tab. The log is kept in
.bot-protection/pow.login your home directory and is rotated automatically at 10 MB, so it will not fill up your disk space. - Reset verification - makes every visitor pass the check again once. Useful after raising the difficulty.
URL rules
On the "URLs" tab, rules can be entered in "Simple" mode (for example, "starts with /old-cart/") or "Advanced" mode, which accepts a regular expression matched against the path and query string. Built-in rules can be turned off with "Turn off" if one doesn't suit your site, without deleting it. The "Most requested URLs" list on the Activity tab has "Block" and "Never challenge" buttons that fill in the form for you.
IP validation
This optional setting on the "Sites" tab ties a visitor's pass to the connection that earned it, so it cannot be copied and reused from somewhere else. Most sites do not need it. With it on, visitors whose address changes (for example, phones switching between Wi-Fi and mobile data) may be asked to verify again.
Related Bot Protection Articles
You can find these in the Bot Protection category of our knowledgebase:
- Getting Started with Bot Protection
- Allowing Your IP, Apps and Bots
- Using a CAPTCHA with Bot Protection
- Troubleshooting Bot Protection
Need More Help?
If you have questions about Bot Protection or something isn't working the way you expect, please open a support ticket from our Client Area and our team will be happy to help. To help us get you an answer quickly, please include:
- The website (domain) affected.
- Any Reference code shown on a blocked page.
- Roughly when it happened and what you or your visitor were trying to do.
