Skip to content

v0.5.0 wordpress.org review 2: Search bot check, endpoint paths, probe evidence, AbuseIPDB reports

Choose a tag to compare

View all tags
@rafael-minuesa rafael-minuesa released this 11 Oct 10:19
· 5 commits to main since this release
v0.5.0
335e3f8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Answers the second wordpress.org review, and adds probe evidence and AbuseIPDB reports to GitHub builds. Full list in CHANGELOG.md.

  • Search bot check on the Settings tab, off by default. The reverse and forward DNS check of visitors claiming to be Googlebot, Bingbot, Applebot or Yandex runs only when it is on. Off, those visitors count as "not checked" and are never banned, so a scanner pretending to be a search engine is not banned either. Switch it on after updating if your site relied on the check.
  • The admin-ajax, admin, login, XML-RPC, comment, cron and REST paths come from WordPress, so a moved admin or login page is classified correctly.
  • Google's user-triggered fetchers (Read-Aloud) count as ordinary visitors instead of a search-bot claim.
  • GitHub build only: probe bans and would-be bans show the probed paths and user agents, and probe bans can be reported to AbuseIPDB (off by default, by hand or automatic, with a daily cap).
Assets 3
Loading