Skip to content

v0.2.0 The gate: probe refusal, address bans (observe mode first), Bans tab, replay --gate

Choose a tag to compare

View all tags
@rafael-minuesa rafael-minuesa released this 01 Oct 10:33
· 48 commits to main since this release
v0.2.0
be9b680

Bot Storm Radar now protects as well as reports. Probe refusal is on from the start. Address bans start in observe mode: they are listed as bans that would have happened, and nobody is refused until you switch them on.

The gate

  • Runs before themes and plugins, from a must-use plugin the plugin installs.
  • Can run before WordPress itself with early protection (Settings, Gate), through auto_prepend_file in .user.ini or .htaccess. That is opt-in and verified with a request to the site.
  • Never loads WordPress or queries the database.
  • A file named disabled in its data directory switches it off within one request.

Probe refusal: a 403 before WordPress loads for:

  • .env and other dot-files (/.well-known/ excepted);
  • copies of PHP files;
  • configuration and log files;
  • backups and dumps outside uploads;
  • a list of other applications' admin paths;
  • .php files that do not exist.

Files the web server serves itself never reach it. Settings, Probes, holds the switch, the full list and your own exceptions.

Address bans by trips (Settings, Address bans)

  • An address that probes 3 times in 10 minutes, or asks for 20 missing pages in a minute, is banned for an hour, or a day on a repeat.
  • Never banned: administrators, verified search bots, Cloudflare, declared proxies and a never-ban list.
  • A search-bot claim is verified by DNS first.
  • With APCu the gate bans on the request that trips. Without it the ban lands at the next minute tick.
  • One mail when more than 10 addresses are banned in an hour.

Bans tab: bans with their evidence and Unban, would-be bans, and claims waiting for verification.

wp bot-storm-radar replay --gate <logs>: a dry run over your own access logs. It reports what the gate would refuse and ban, and the WordPress builds that saves. Nothing is written.

Upgrading from 0.1.x needs nothing. The first request after the update creates the ban tables and the data directory and installs the gate. See CHANGELOG.md for the details.

Assets 3
Loading