Bothammer is not a one-trick plugin. It is a complete threat intelligence platform built into WordPress — from the moment a bot knocks on your door to the moment you file an abuse report with their ISP.
Multiple detection methods working in parallel — behaviour analysis, IP reputation checks, pattern recognition, User-Agent fingerprinting, and honeypot triggers. Bothammer builds a threat score per visitor and acts accordingly, without slowing down legitimate traffic.
Hidden trap links invisible to real users — only bots follow them. The moment one does, they're fingerprinted, logged, and added to your blacklist instantly. No false positives, no manual review, no configuration required beyond dropping the trap link in your template.
Your personal holding cell for every captured bot. Search, sort and filter your entire bot database with live auto-refresh. See their User-Agent, requested URL, country, ASN, threat markers, case notes and full IP history — all from one screen. Find any entry in seconds.
Force suspicious visitors to pass a JavaScript challenge before continuing. Real browsers pass silently. Bots that cannot execute JavaScript fail immediately and get blocked. Choose from Cloudflare Turnstile, hCaptcha, or reCAPTCHA — all managed from one place, no extra plugins.
2FA on wp-login, contact forms, forums, and WooCommerce checkout — your choice, per context. Combine with JS challenges or captcha for layered verification. No separate 2FA plugin needed — it lives inside Bothammer and shares the same configuration interface.
Crowd-sourced bot intelligence shared across every Bothammer Pro and Agency installation. When a bot gets caught on one site, that IP is distributed to the entire network within 5 minutes. Pro licences send and receive. Agency licences add private federation keys — a closed ring where only your trusted sites share data with each other, separate from the public feed. Secured by per-site HMAC, hosted on Cloudflare's edge, 7-day rolling TTL.
Connect your own API keys for AbuseIPDB, IPinfo.io, MaxMind, VirusTotal, Greynoise, and Shodan. Bothammer cross-references every bot against these services and adds the enriched data to the bot's profile. The settings API tab shows exactly how many API calls you have remaining on each service.
Every IP address gets its own case file. Add notes, assign severity levels, log actions taken, and attach evidence. Turn on AI auto-logging and Bothammer builds the timeline automatically whenever an action is taken against that address. Export any case file to CSV, HTML, or PDF to attach to security reports or escalations.
An AI system that activates when a bot's threat score crosses your configured threshold. It scans the entry against local patterns and known internet threat databases, builds an analysis, and surfaces it directly in your dashboard as an AI Forecast. Tells you what you need to know right now, not after you've dug through logs.
Bothammer does reverse IP lookups to triangulate each bot's latitude, longitude, and street address using AbuseIPDB, IPinfo.io, or MaxMind. Visualise bot origins on a live global map. See which nation states are most aggressive. Block entire countries with a single click. Heatmaps show attack density at a glance.
Configure keyword and location-based news feeds that surface events relevant to your threat landscape. Government toppled, troop movements, economic sanctions, civil unrest — Bothammer pulls it to your dashboard in real time. Hot events (where multiple sources push the same story) appear in a distinct colour so you notice them immediately. Overlay events against bot attack data on your map and start connecting the dots.
Three modes — passive, moderate, and aggressive — that shift how aggressively Bothammer acts on suspicious traffic. Passive monitors and logs. Moderate challenges and rate-limits. Aggressive blocks and blacklists on first contact. Switch modes globally or per-rule depending on your current threat level.
Full control over exceptions. Whitelist by secret key, IP, ASN, country, or User-Agent. Blacklist by IP range, ASN, country, string match, or User-Agent. Bulk import from Cloud WAF exports. Everything is editable in a searchable table — no config files, no terminal access needed.
Set a custom message per block level. Tell a rate-limited bot something different to a fully blacklisted one. Full HTML support — say "Hasta La Vista" in style or keep it clinical. Custom messages are served as bare 403 pages that skip the WordPress bootstrap entirely, so even under attack your server stays responsive.
Create custom automated response scenarios that go far beyond a simple block. Redirect attackers through a maze, feed them fake data, run a script, or chain multiple actions together. Choose from the built-in ATR library, write your own, or load from an external file. The Intelligence page lets you inspect the live behaviour of any running ATR script.
Redirect specific IP addresses or entire countries to a custom URL — useful for economic sanctions compliance, regional licensing restrictions, or simply sending Russian bots to a brick wall page. Applied per-IP or per-country, with full control over the destination URL.
Bots hammer missing asset URLs relentlessly. Normally WordPress boots the full PHP stack and hits the database for every single one. Bothammer serves a stripped-down 404 for assets — no WordPress bootstrap, no SQL calls, instant response. Your server handles ten times the volume for the same CPU cost, which is especially helpful when you are getting hammered by bots. And as a bonus, we will alert you when they happen as it might indicate a problem with your site, potentially loosing business.
Automatically push your Bothammer blacklist to Cloudflare WAF and AWS WAF on a schedule or instantly on block. Your server-level intelligence feeds directly into your front-line DNS defences, closing the positive feedback loop. Bots blocked at the server today are blocked at the edge tomorrow — before they even reach you.
Beyond cloud WAFs, Bothammer syncs your blacklist directly to nftables at the kernel level. Blocked IPs never reach your web server or application stack at all — the kernel drops the packet before Apache or Nginx even wakes up. Maximum protection, minimum server load.
Deep file-level scanning of your WordPress installation. Schedule scans, get alerted when files change unexpectedly, and catch shellcode injection attempts before they execute. The most in-depth scanner available for WordPress — not a signature database check, but actual heuristic analysis of file behaviour.
Get alerted where you actually are. Bothammer supports Slack, Telegram, Twilio SMS, Twilio Voice calls, Home Assistant (via REST sensors), and email. Set triggers per-event — bot block, high attack rate, rate limit hit, CPU spike, WAF sync failure — and choose which channel gets which alert. Automation examples included for Home Assistant integration.
A full HTML and CSS editor for the abuse emails you send to ISP abuse teams and the admin alerts you receive. Apply your organisation's branding. Send individual reports or bulk-report an entire ASN. Track follow-ups per IP. Build a complete correspondence history as part of the IP case file.
A heads-up display that tells you at a glance: current threat level, status of all defences, last attack timestamp, live bot feed, and an AI forecast. The dashboard map shows bot origins in real time, with heatmap overlays, tag views, event overlays, and — yes — a freehand paint tool so you can literally draw on the map to highlight emerging threat zones for your team.
Rewind your threat landscape to any point in history. Time-based playback with multiple overlay options — geopolitical events, bot tags, attack heatmaps, country rankings. If a country climbs to the top of the bot rankings, Bothammer starts pulsating it on the map to demand your attention. Review what happened before, during, and after any incident.
Pre-built charts covering your top 15 attackers, blacklist performance, system pressure, and queue pressure. Plus a full SQL report generator — write any query against your bot database and turn it into a chart, export to CSV, or save as an image to attach to security briefings. No external BI tool needed.
Every action Bothammer takes — and every world event you subscribed to — lands in a unified calendar. Add your own annotations with full HTML notes, priority flags, coordinates, and a snapshot of system status at the time. Export to Google Calendar, Outlook, or iCal. Subscribe so your ops team always sees what's happening even when nobody is logged in to the admin panel.
Tag any IP or bot with custom labels. Hover over an IP anywhere in the interface and see its tags instantly. Create tag colours using the keyword editor — any bot matching a keyword automatically inherits that colour and severity level. Use tags as a map overlay to visualise which threat actors are clustered in which regions.
Overlap any combination of data layers on your dashboard — geopolitical events, bot tags, heatmaps, country rankings, custom annotations — and correlate attack spikes with real-world events across timezones. Connect the dots between a news event in one timezone and an attack spike six hours later in yours.
When a bot storm saturates your server, you lose the ability to log in, reconfigure, or even shut down cleanly. CPU Guardian monitors server load and takes configurable action when thresholds are crossed — temporarily suspend the HTTP daemon, permanently shut it down, close only the public interface while keeping internal access live, send an alert, or execute a custom script. You get notified when it triggers, why it triggered, and when the server comes back up.
Modern cgroup slice management that guarantees you can always log in to your server even during a full attack. Graduated request delays when concurrency spikes — slow them down before you block them. Auto-blacklist on threshold breach. Say goodbye to OOMkiller events that are impossible to trace after the fact.
Detailed activity logs for every action Bothammer takes — blocks, rate limits, WAF syncs, scan results, cron jobs, and system events. Set data retention limits to keep your database from growing unbounded on high-traffic sites. Turn off logging temporarily during extreme attacks if the logging itself is adding load. Every log entry is timestamped and searchable.
Search, display, anonymise, or delete any IP address record from the admin panel. Wipe your entire bot database with one click if you need to start fresh. Set per-table data retention policies from the settings menu — recommended on high-traffic sites where Bothammer can easily process hundreds of thousands of bot records per month.
Bothammer models the impact it's having on your site over time — showing how much your attack volume has decreased since installation, how well your blacklists are performing, and how much CPU time and bandwidth cost you've saved. Useful for justifying the licence cost to a security officer or making the case for infrastructure investment to management.
Every feature above is available today. Pick a plan and have Bothammer running on your site in under ten minutes.
See Pricing →