Performance
Sub-2 ms overhead and challenge pages that skip the WordPress bootstrap — protection without a speed penalty
WordPress · Website Toolkit
The Lightweight Bot Firewall for WordPress
Stop malicious bots, aggressive crawlers, and automated attacks before WordPress even loads. Under 2 milliseconds of overhead. DNS-verified crawler whitelist. GDPR-compliant by default.
SEO Safety
DNS-verified crawler whitelist guarantees Google, Bing, and social preview bots are never blocked — rankings and link previews stay intact
GDPR Compliance
Hashed IPs, local GeoIP, automatic data pruning, zero telemetry, no external calls in core mode
Server Cost Reduction
Blocking bot floods, scrapers, and scanners before WordPress loads frees CPU, database, and bandwidth for real visitors
What it's about
WP PM Shield Firewall
PM Shield Firewall protects your WordPress site from malicious bots, scrapers, brute-force attacks, and automated traffic floods — without the overhead of heavy security suites. It inspects every incoming request at the earliest possible moment, lets legitimate visitors and verified search engine crawlers pass through transparently, and challenges or blocks everything suspicious.
The plugin is engineered for speed. Pass-through requests add less than 2 milliseconds of latency. When a challenge is triggered, it renders inline at the visitor's original URL — no redirect, no URL change — and responds in under 50 milliseconds because it runs without loading the full WordPress stack.
Privacy is built in, not bolted on: IP addresses are hashed with SHA-256 by default, geolocation runs against a locally stored database, and the plugin makes no external API calls in core mode and sends no telemetry.
PM Shield Firewall is included free of charge with a premotion media managed WordPress hosting agency server — for unlimited WordPress installs.
Features
Thought through to the daily workflow.
Every building block is focused on a clear benefit and fits into existing processes.
Feature Section
Rate limiting is active out of the box. A sliding window algorithm tracks requests per IP address and challenges or blocks visitors who exceed your configured threshold. Repeat offenders are escalated automatically: an IP that keeps triggering the rate limit is auto-blocked for a configurable duration.
Intelligent Rate Limiting — Sliding Window Traffic Control
Rate limiting is active out of the box. A sliding window algorithm tracks requests per IP address and challenges or blocks visitors who exceed your configured threshold. Repeat offenders are escalated automatically: an IP that keeps triggering the rate limit is auto-blocked for a configurable duration. Choose the storage backend that fits your server — file-based storage, WordPress transients, or Redis for high-traffic setups.
- Sliding window algorithm with configurable request threshold and window size (default: 60 requests per 60 seconds)
- Configurable action on violation: challenge or block
- Automatic escalation — repeat violators are auto-blocked (default: 24 hours after 3 violations within an hour)
- Three storage backends: File, Transient, and Redis
- Trusted proxy header support for correct visitor IPs behind Cloudflare, load balancers, and reverse proxies
Inline Human Verification — Challenges Without Redirects
When a visitor needs to prove they are human, PM Shield Firewall renders the challenge directly at the original URL. No redirect to a separate page, no URL change, no external requests — all CSS and JavaScript are inlined with CSP nonces. After successful verification, a POST-Redirect-GET cycle returns the visitor to exactly where they were, carrying an HMAC-signed cookie. Three challenge modes cover every scenario, from zero-setup math questions to invisible proof-of-work.
- Math Challenge: a simple arithmetic question with three difficulty levels, no setup required
- ALTCHA Proof of Work: invisible to visitors — the browser solves a SHA-256 puzzle automatically, no API key needed
- ALTCHA Sentinel: advanced adaptive bot detection via a self-hosted Sentinel server you control
- Brandable challenge page: your logo, primary color, and custom message
- Configurable cookie lifetime, plus automatic IP lockout after repeated challenge failures
Verified Crawler Whitelist — SEO-Safe by Design
Blocking bots must never mean blocking Google. PM Shield Firewall ships with a whitelist of more than 30 verified crawlers — including the full Google bot family, Bing, DuckDuckGo, Yandex, Applebot, Baidu, Naver, SEO tools like Ahrefs, and the social media link preview bots from Facebook, Twitter, LinkedIn, Pinterest, Slack, Discord, Telegram, and WhatsApp. Every crawler is verified via reverse DNS lookup, so a bot merely claiming to be Googlebot in its user agent gets no free pass. Verified crawlers bypass rate limits, country rules, and challenges entirely.
- 30+ verified crawlers including specialized Google bots (Googlebot-Image, Google-InspectionTool, Storebot-Google, and more)
- Reverse DNS verification with 24-hour caching — user-agent spoofing does not work
- Social media link previews keep working on every platform
- Verified crawlers are never blocked, challenged, or rate-limited
Country Blocking — Local GeoIP, No External Lookups
Allow or block traffic by country using the MaxMind GeoLite2 database, which is bundled with the plugin and stored locally on your server. No visitor data is ever sent to a third party for geolocation. Choose allow-list or block-list mode, decide whether matched countries are challenged or blocked, and keep the database current with optional automatic updates or a direct upload from the admin interface.
- Country allow and block modes with per-country selection
- Bundled MaxMind GeoLite2 database — all lookups run locally
- Upload your own .mmdb database file directly via the admin UI
- Optional automatic database updates using your own MaxMind license key
- Configurable action per match: challenge or hard block
8G Firewall Rules — Including an AI Crawler Blocker
Extend protection to the web server level. PM Shield Firewall can write the well-known 8G Firewall ruleset by Perishable Press into your site's .htaccess file — blocking SQL injection attempts, XSS payloads, bad bots, and other common attack vectors before PHP even starts. An extended ruleset adds an AI crawler blocker that stops more than 180 AI and LLM crawler user agents, including bots from ChatGPT, Claude, Gemini, Grok, and many others — giving you control over whether your content feeds AI training pipelines.
- One-click installation of 8G Firewall rules above the WordPress rewrite block in .htaccess
- Optional extended ruleset: 8G Firewall plus AI Crawler Blocker with 180+ blocked AI/LLM user agents
- Full rule preview in the admin before anything is written
- Clean removal — rules live between clearly marked begin/end markers
Bad Bot Trap — Honeypot for Rule Breakers
Catch bots that ignore the rules. The Bad Bot Trap injects a hidden link into your pages that no human ever sees and no legitimate crawler ever follows — because robots.txt explicitly forbids it. Any client that visits the trap URL has identified itself as a bad bot and is blocked automatically.
- Invisible honeypot link injected into your pages
- Managed robots.txt entry keeps legitimate crawlers away from the trap
- Automatic blocking of trapped bots with configurable duration (default: 24 hours)
- Trapped bot statistics visible in the admin
Login Protection and WordPress Hardening
Protect the most attacked endpoint of every WordPress site. Restrict login access to specific IP addresses, and lock out clients after repeated failed login attempts. Beyond the login page, a set of hardening toggles reduces your site's overall attack surface.
- Login IP allowlist — only approved addresses reach the login form
- Brute-force lockout with configurable retry limit and lockout duration
- Disable XML-RPC completely, including pingbacks and the X-Pingback header
- Disable comments site-wide and remove comment UI from the admin
- Block user enumeration via author archives, the REST API users endpoint, and sitemaps
- Hide the WordPress version from HTML and RSS feeds
- 404 Guard: automatically block IPs generating excessive 404 errors — the signature of vulnerability scanners and URL probing
Operating Modes — Monitor, Enforce, Under Attack
Never deploy a firewall blind. Monitor mode runs the complete firewall pipeline and logs every decision without blocking or challenging a single visitor — perfect for observing real traffic and calibrating thresholds before enforcement goes live. When things get rough, Under-Attack Mode forces every unverified visitor through human verification. Toggle it manually from the dashboard or via WP-CLI, or let the plugin activate it automatically when traffic crosses a threshold you define.
- Monitor mode: full dry-run with complete decision logging, zero enforcement
- Enabled mode: full enforcement with blocks, challenges, and auto-blocking
- Under-Attack Mode: emergency toggle that challenges all visitors, with shortened cookie lifetime
- Optional automatic under-attack activation based on traffic thresholds
Live Monitoring, IP Management, and Logging
A dedicated top-level admin menu gives you a real-time view of what the firewall is doing. The live monitor polls continuously and shows a gauge plus an activity feed of blocked and challenged requests — in both monitor and enforcement modes. IP management supports precise, flexible rules, and the logging dashboard keeps history exactly as long as you want it to.
- Live dashboard with real-time gauge, activity feed, traffic statistics, and under-attack toggle
- IP allow/block lists with single IPs, CIDR ranges, and IPv6 support
- CSV import and export of IP rules, with optional rule expiration dates
- Filterable log viewer with block-reason breakdown and challenge success rates
- Configurable retention (default: 30 days) with automatic hourly pruning and a hard row cap
Automation — WP-CLI, REST API, and MU-Plugin
Everything you can do in the admin, you can script. A full WP-CLI command set and a REST API make PM Shield Firewall a first-class citizen in automated deployments, monitoring stacks, and multi-site management workflows. For maximum protection, an optional must-use plugin loads the firewall before all other plugins and themes — installable with one click from the dashboard.
- WP-CLI commands for under-attack toggling, IP rule listing/import/export, log flushing, GeoIP updates, statistics, and IP testing
- REST API namespace for programmatic control and external integrations
- One-click mu-plugin installation for earliest possible request interception
- Extension filter hook for custom firewall decisions in your own code
How it works
A clear path to the result.
- 01
Step 1 — Activate and Observe
Activate the plugin and open the PM Shield dashboard. Enable monitor mode to run the full firewall pipeline in dry-run: every decision is logged, nothing is blocked. Watch real traffic patterns in the live monitor.
- 02
Step 2 — Calibrate Your Thresholds
Review the logs and adjust rate limit thresholds, window sizes, and actions to match your traffic profile. Behind Cloudflare or a reverse proxy? Set the trusted proxy header so the firewall sees real visitor IPs.
- 03
Step 3 — Configure Your Protections
Pick a challenge mode, enable country blocking if needed, install the 8G firewall rules, activate the bad bot trap, and switch on login protection and hardening options — each feature toggles independently.
- 04
Step 4 — Go Live
Enable enforcement. Legitimate visitors and verified crawlers pass through untouched; suspicious traffic gets challenged or blocked. Optionally install the mu-plugin for the earliest possible request interception.
- 05
Step 5 — Respond and Automate
Watch the live dashboard, manage IP rules, and export logs. During an attack, flip on Under-Attack Mode from the dashboard or via WP-CLI — or let automatic activation handle it for you.
Who is it for?
Made for concrete requirements.
The solution is a particularly good fit for these teams, roles and business models.
Agencies and Site Managers
Roll out consistent bot protection across every client site. WP-CLI and REST API support make firewall configuration part of your standard deployment pipeline, and monitor mode lets you tune each site safely before enforcement.
WooCommerce and E-Commerce Stores
Stop card-testing bots, scalper scripts, and scraper traffic without ever blocking a paying customer or a Google Shopping crawler. Inline challenges keep the checkout flow intact — no redirects, no lost sessions.
High-Traffic Blogs and Publishers
Cut server load caused by aggressive crawlers and content scrapers. The AI crawler blocker gives you the choice of whether 180+ AI/LLM bots may harvest your content.
Membership and Community Sites
Protect login pages with IP allowlists and brute-force lockouts. Disable XML-RPC and user enumeration to close the most common attack paths against user accounts.
Privacy-Focused and EU-Based Sites
GDPR compliance by default: hashed IP addresses, local geolocation, configurable data retention, no external API calls, no telemetry. Security without a privacy trade-off.
Developers and System Administrators
Full programmatic control via WP-CLI and REST API, three rate-limit storage backends including Redis, an mu-plugin for early interception, and a filter hook for custom firewall logic.
Tech & scope
The key details at a glance.
- Version
- 1.2.3
- WordPress Minimum
- 6.4
- PHP Minimum
- 8.3
- PHP Extensions
- mbstring, json, openssl, filter, gmp
- License
- GPL-2.0+
- Performance Overhead
- Under 2 ms per pass-through request
- Challenge Response Time
- Under 50 ms, rendered without the WordPress bootstrap
- GeoIP
- MaxMind GeoLite2, bundled and stored locally
- Rate Limit Storage
- File, Transient, or Redis
- IP Storage
- SHA-256 hashed by default
- Telemetry
- None
- Log Retention
- Configurable (default 30 days) with automatic pruning
- Interfaces
- Admin dashboard, WP-CLI, REST API
- MU-Plugin
- Optional, one-click install for earliest interception
- Languages
- English, German (de_DE, de_AT)
- Author
- premotion media
- Hosting
- Included free with a premotion media managed WordPress hosting agency server
- Installs
- Unlimited per agency server
FAQ
Frequently asked questions.
Will PM Shield Firewall slow down my site?
No. The firewall adds less than 2 milliseconds of overhead per pass-through request. Challenge pages render inline at the visitor's original URL without loading the full WordPress stack and respond in under 50 milliseconds.
Will search engines or social media previews be blocked?
No. More than 30 crawlers — including Google's specialized bots, Bing, DuckDuckGo, and the link preview bots from Facebook, Twitter, LinkedIn, Pinterest, Slack, Discord, Telegram, and WhatsApp — are verified via reverse DNS lookup and always pass through, regardless of rate limits or country settings.
Is PM Shield Firewall GDPR compliant?
Yes, by default. IP addresses are stored as SHA-256 hashes, geolocation runs against a locally stored MaxMind GeoLite2 database, the plugin makes no external API calls in core mode, sends no telemetry, and prunes logs automatically based on your configured retention period.
Can I block AI crawlers like ChatGPT or Claude bots?
Yes. The Firewall Rules tab offers the 8G Firewall ruleset with an optional AI Crawler Blocker extension that blocks more than 180 AI and LLM crawler user agents at the web server level — including bots from ChatGPT, Claude, Gemini, and Grok.
Does it work behind Cloudflare or a reverse proxy?
Yes. Set the trusted proxy header in the settings (for example the Cloudflare connecting-IP header) so the firewall sees real visitor addresses instead of proxy IPs. Without it, rate limiting cannot distinguish individual visitors.
What is monitor mode?
Monitor mode is a dry run: the complete firewall pipeline executes and logs every decision, but no visitor is ever blocked or challenged. Use it to observe traffic and fine-tune thresholds before switching on enforcement.
What happens during an attack?
Toggle Under-Attack Mode from the dashboard or via WP-CLI to force every unverified visitor through human verification — or configure automatic activation when traffic exceeds a threshold you define. Verified search engine crawlers still pass through normally.
Is this plugin included with premotion media hosting?
Yes. PM Shield Firewall is included free of charge with every premotion media managed WordPress hosting agency server. Install it on every WordPress site you manage — no per-site licensing and no add-on fees.
Ready?
Serious Bot Protection Without the Bloat
PM Shield Firewall gives every WordPress site enterprise-grade bot defense in a lightweight package: intelligent rate limiting, inline human verification, country blocking, AI crawler control, a honeypot trap, login protection, and hardening — all with under 2 milliseconds of overhead and GDPR-friendly defaults. Calibrate safely in monitor mode, enforce with confidence, and flip on Under-Attack Mode when it matters. Included free with premotion media managed WordPress hosting.
Discuss your project