If your site runs on WordPress, you already know: bots are not just a nuisance—they are a full-fledged threat to your business. They don't just leave comments with casino links; they steal content, simulate ad clicks, drain hosting resources, and turn analytics into a pile of useless numbers.
The problem is made worse by the fact that classic protection methods—captchas, honeypots, cloud WAFs—either annoy real customers, are easily bypassed by modern emulators, or both at once. When it comes to protecting against scraping and DDoS, most site owners hit a dead end: plugins like Wordfence charge for signature databases but still let neural-network spam through, while free solutions cover only one front and leave all other entry points wide open.
At HaltClick, we took a different path and built an antibot that works at the PHP level, intercepts every HTTP request before it reaches the WordPress core, and decides whether to block within milliseconds—without captchas, without losing conversions, and without compromising security. Let's break down how it works and why it is the only rational choice.
Why WordPress Is a Prime Target for Bots, Scrapers, and DDoS Attacks
WordPress has one fatal security property: standardization. All sites on this CMS share the same form handler URLs, the same REST API endpoints, and predictable structures for wp-comments-post.php and xmlrpc.php. A bot doesn't need to study a specific site—it simply runs a ready-made script across millions of domains, probing every entry point.
Main attack vectors:
-
Content scraping Competitors and aggregators use scrapers to copy product descriptions, articles, and prices. Your unique texts lose value, and SEO positions drop. Modern scrapers use headless browsers and bypass complex JS protections, leaving owners with a false sense of security.
-
Click fraud Bots simulate clicks on ads in Google Ads and other PPC platforms. Your daily budget is burned in a couple of hours, while real inquiries never arrive.
-
DDoS and server overload Even a relatively small attack on
xmlrpc.phpcan take your site down. Instead of sales, you get downtime, resource overage bills, and lost customers. -
Spam registrations and fake accounts Bots create thousands of accounts via
wp-login.phpand the REST API, fill your database with junk, and use the accounts for spam and profile links. -
Garbage analytics Dozens of fake visits with zero page depth create the illusion of traffic. Marketing decisions based on such data lead to wasted budget.
Traditional responses like captchas or honeypot fields no longer work: they irritate real users and are easily bypassed by AI services that recognize graphical captchas more accurately than humans and cost pennies.
Overview of Existing Solutions: Why Most of Them Fail
The WordPress anti-bot market is full of offers, but almost all of them suffer from the same shortcomings.
Traditional methods
- Filter plugins (Akismet, CleanTalk): They work after the fact. The bot has already reached PHP and the database, creating load. In 2026, neural-network spam from ChatGPT-like models easily bypasses signature-based filters.
- Captcha (reCAPTCHA, SmartCaptcha): Reduces form conversion by 10–40%. To protect yourself, you sacrifice customers, and modern bots bypass it via AI services.
- Cloud WAFs (Cloudflare, Wordfence Premium): Effective but expensive. Moreover, routing traffic through third-party servers raises data privacy and compliance concerns, and in some regions Cloudflare protection has become unavailable since mid-2025.
- Honeypots and hidden fields: Only catch primitive bots. Headless-browser emulators recognize them by CSS and easily bypass them.
- Caching plugins (W3 Total Cache, LiteSpeed): Checks at the
.htaccessor Nginx level are incompatible with anti-bots because the cache is served before PHP starts.
Solution: HaltClick Antibot
Site owners face a choice: pay for a WAF, put up with bots, or install a conversion-killing captcha. The server-side PHP antibot solves this problem fundamentally—it stops requests before WordPress loads and instantly drops bot connections using multi-layered analysis instead of captchas.
How PHP-Level Protection Works
The HaltClick antibot is a lightweight PHP and JavaScript module installed directly on your server. It intercepts every incoming HTTP request before it reaches your site's pages. The check is performed locally using metrics loaded from our analytics—you are not dependent on cloud proxies and do not change your DNS.
Technical architecture and 3 layers of protection:
PHP session controllers and trust token
Request interception happens at the very start. The script instantly checks the cryptographic signature in the visitor's cookies (the HaltClick trust token). If present, access opens immediately without re-verifying real users. The decision is made before the interpreter starts compiling the heavy WordPress core and initializing MySQL connections.
Browser fingerprint and JS challenge
If no trusted session exists, the user is served a lightweight invisible vanilla JavaScript script. It collects WebGL parameters, Canvas rendering, available fonts, audio context features, screen resolution, and language in the background. Real devices have unique fingerprints; emulators are stereotypical or missing.
Dynamic hashing and behavioral analysis
The collected data is hashed on the client side and returned to the server. Bots without natural JS execution delays (or returning a stereotypical hash) receive a 429 error. A human visitor only sees a brief loading indicator flash.
Asynchronous synchronization
The module runs autonomously: signature exchange with the server occurs once every 10 minutes, and search bot subnet updates once every 6 hours. Background requests do not block the main thread and do not slow TTFB for the end user.
Scraping Protection: Why Fingerprinting Beats IP Blocking
Scraping is one of the most painful problems for content projects and online stores. Traditional protection methods—IP blocking, User-Agent restrictions, robots.txt—are long outdated. Modern scrapers rotate proxies, change User-Agents, and ignore rules.
The HaltClick antibot analyzes browser fingerprints and behavioral patterns. A scraper cannot emulate the unique font set and WebGL fingerprint of a real device. Any attempt to fake it produces a stereotypical fingerprint that instantly lands on the blacklist.
At the same time, legitimate search bots—Google, Bing, Apple, Baidu, DuckDuckGo, and others—are automatically allowlisted by IP. Your indexing remains completely safe.
DDoS Protection: Preventing Server Overload
DDoS attacks on WordPress most often target xmlrpc.php, the REST API, and wp-comments-post.php. Because the module runs before the request reaches the WordPress core, it prevents bots from even touching the database or loading PHP handlers. This means:
- The server does not waste resources processing bot requests.
- The database is not flooded with fake comments and registrations.
- Server and database load drops by 25–35%, and response time for real users improves (especially critical for WooCommerce stores).
Analytics Block: Visualization and Transparent Metrics
Abstract bot blocking is good, but clients need to see exactly who the system stopped. A detailed monitoring dashboard is available:
- Isolated incident analytics: All blocked bots (receiving a 429 status) are logged in an independent dashboard. This keeps your Google Analytics and other analytics data perfectly clean.
- Interactive visualization: Attack statistics are displayed through dynamic charts (built on libraries like ApexCharts/Chart.js). Site owners see hourly breakdowns of scraper activity, brute-force attempts, and ad-click spikes.
- Ad ROI assessment: The system lets you visually compare UTM-tagged visits with blocked emulators, showing the exact amount of budget saved.
WordPress Installation and Setup: Step-by-Step Guide
Connecting the Antibot to WordPress takes just a few minutes and requires no complex code changes:
- Download the module archive from your HaltClick dashboard.
- Extract the archive to the site's root directory via FTP/SFTP. Make sure the uploaded folder has write permissions (755 or 775) so the plugin can update its signatures.
- Connect the module via wp-config.php. Add this line right after
<?php:
Alternative methods: viainclude($_SERVER['DOCUMENT_ROOT'] . '/haltclick-xxxxxxxxxxx/haltclick.php');.htaccess(thephp_value auto_prepend_filedirective) or via.user.ini. - Configure allowlists:
- Add your server's IP to the rules list with Allow mode.
- Add
/wp-cron.phpto the rules list with Allow mode. - For WooCommerce, add
/?wc-ajax=to the rules list with Allow mode (if you see STOP status in the logs).
- Check cache compatibility: The best choice is WP Super Cache (it checks the cache at the PHP level). W3 Total Cache and LiteSpeed Cache are incompatible because they serve the cache before the PHP script runs.
- Configure analytics: In your Google Tag Manager or analytics code, replace
referrer: document.referrerwith reading the referrer fromsessionStorageaccording to the instructions.
Flexible Blocking Rules
The «Antibot» section provides a powerful tool for custom traffic filtering. Checks can be based on Referer, User Agent, Host, URI, IP, PTR, GET parameters, Lang, and headers. Contains/does not contain, starts with/ends with, and regular expression modes are supported.