Bothammer was built by us because we got tired of watching WordPress sites get hammered by bots while cloud WAFs reported everything was fine.
So we built the tool we wished existed — one that sees what WAFs cannot, knows what they do not, and feeds intelligence back to every layer of defence automatically.
Every new WordPress installation gets found within minutes. Thousands of bots a day rattle the doorknobs — probing wp-login.php, xmlrpc.php, .env files, admin panels. Most are dumb and automated. Some are not. Those are the ones we really care about. And this is why information has to come from the source, your server, your network.
If your site gets hit, and it will once they figure out your real IP address, it will cost you bandwidth, money and cpu credits. But if it goes down, it will cost more. Your brand will suffer damage, and your customers will quickly flock to your competitors. You cannot afford that. But you can afford Bothammer.
The standard advice is to put a cloud WAF in front of your site and call it done. And a WAF is useful — for DDoS absorption, for killing the very bottom of the barrel. But a WAF only works on DNS. It has no view of your server. It cannot see what is actually hitting you, and it cannot tell the difference between a bot that scraped your content last Tuesday and a targeted attacker who found your origin IP yesterday.
True threat intelligence can only come from the source. That is your server. That is Bothammer.
"If you know the enemy and know yourself, you need not fear the result of a hundred battles."
— Sun Tzu, The Art of War
The world is a geo-political minefield. The modern cyberscape is always at war. You need server-based intelligence in addition to cloud defences. Sending your whole garrison ahead to surprise the enemy and leaving your castle unprotected is not a strategy — it is an invitation.
Bothammer sits inside your WordPress installation and sees everything. Every request, every User-Agent, every suspicious string in a URL, every bot that follows a honeypot link, every IP that hammers your login page. It builds a threat score in real time and acts on it — blocking, rate-limiting, challenging, redirecting, or logging — based on rules you control.
That intelligence then flows outward. Bots that get caught on your site feed into the Bothammer Intelligence Network, where they get distributed to every other Pro and Agency installation within minutes. Or if you choose to trust only your own sites, you create a federation. And your WAF blocklists — Cloudflare, AWS, your kernel firewall — stay in sync automatically. Your server-level intelligence becomes your front-line defence.
That is the positive feedback loop. That is what makes Bothammer not just a last line of defence but the first one too. We close the loop.
Bothammer is not a set-and-forget plugin. It is a platform you grow into. Start in passive mode, slowly exploring your options, while having full control. Then move up in level, whenever you are ready. Add geopolitical event feeds when you want to understand why attack volumes spike around certain world events. Build out your IP case files as you identify recurring threat actors. Set helpful tags. Use the Time Machine to review what happened during your last incident and understand it properly.
Over time, Bothammer builds a picture of who attacks you, when, from where, and why. That picture is yours. No more obscure tools that do not show you what is going on. We show you the ugly truth, right for all to see. It lives in your database, on your server, under your control. No third party holds it, no subscription can revoke access to it, and no WAF vendor can tell you it is not relevant because it does not fit their model.
You own the intelligence. You own the field. Now level it.
"Who's Afraid of the Big Bad Wolf?"
— Three Little Pigs
Cloud WAF providers often require you to change your DNS servers to a third party or their own. Do you really want to hand over the keys to your kingdom by handing over your most critical infrastructure setting? At best it is security through obscurity, at worst the road signs to your castle are replaced by something pointing the wrong way one day, maybe to the big bad wolf's house. No need for huffing and puffing when you roll out the red carpet.
And sometimes the road signs, when you don't control them, point to something that takes out half the internet. Your stakeholders will not accept that you rented the road signs and critical infrastructure be managed by a third party. But imagine if you trust your own security and you stay up while the rest of the internet is down. This will now become a powerful sign of your brand trust and reputation giving a clear signal to investors and buyers alike.
Cloud WAFs are the middle layer, not the foundation. Your server sees the real threat. Start there.
Blocking is easy. Understanding who is attacking you, why, and from where is what gives you lasting advantage.
Everything Bothammer captures lives in your WordPress database. No telemetry sent to us unless you choose the Intelligence Feed.
Server intelligence that does not feed back to your front-line defences is wasted. Bothammer closes that loop automatically.
License checks are cached. The Intelligence Feed runs on a cron. Nothing adds latency to your live request handling.
Sometimes the right move is to temporarily shut the door. CPU Guardian exists precisely for when things get serious fast.