Login lockout
Five failed logins in five minutes locks the address out for an hour.
Witen Blocker for WordPress
Lock out password guessers. Choose which bots get in.
A free security plugin that starts protecting your site the moment you activate it, with two-factor sign-in, crawler-by-crawler control over AI bots, and file scans when you want more. Works on any host, including shared hosting.
Version 0.6.55 · WordPress 6.2+ · PHP 8.1+ · Free from the WordPress Plugin Directory. No account needed.
Coming from another plugin? Compare it with Wordfence or WP fail2ban.
Inside the WordPress dashboard
WordPress 0.6.50. Captured from an isolated test installation with demonstration accounts.
On from the moment you activate
No setup wizard, no account. These run straight away with defaults that suit most sites.
Known exploit blocks
Requests for published WordPress exploits are refused before they reach the vulnerable code.
Comment spam checks
A hidden field and a timing check catch bots. No comment text leaves your site.
Daily file scan
A daily scan flags new and changed files and known malware patterns for you to review.
Your content, your call on AI crawlers
Welcome every AI crawler, block them all, or pick one by one. Every recognised crawler gets its own allow or block switch, and nothing is blocked until you choose.
Crawlers are recognised by their published network ranges as well as their user agent, so a scraper pretending to be Googlebot doesn't get Googlebot's pass.
AI crawlers it recognises
- GPTBot
- ChatGPT-User
- OAI-SearchBot
- ClaudeBot
- PerplexityBot
- Common Crawl
- Meta-ExternalAgent
- Amazonbot
- Applebot
Plus the major search engines and ten uptime monitors, so a rule for one bot never catches the services you rely on.
More when you want it
Two-factor sign-in
Each user can add an authenticator app and print recovery codes. A stolen password alone no longer opens your dashboard.
Tighter rules
Move the login page to a URL only you know, harden .htaccess, keep your own block and allow lists, and turn away clients with no user agent. With a connected account you can also block Tor exit nodes.
Shared blocklists, if you want them
Connect a free Witen account with a one-time setup token and your site receives blocklists built from attacks seen across every Witen site and server.
Run WordPress on your own Linux server? Add Warden and the plugin's findings become firewall blocks, stopping repeat attackers before they reach PHP.
Install in a minute
- In WordPress, open Plugins → Add New Plugin and search for “Witen Blocker”.
- Install and activate it. Protection starts immediately.
- Add your own IP address to the trusted list.
- Open Witen → Firewall → Bots and AI crawlers and choose a policy for each crawler.
Questions about Witen Blocker
Will it slow my site down?
No. Each request is checked against lists held locally on your site, and scans and updates run in the background.
Can I use it alongside Wordfence or another security plugin?
Yes. Turn off two-factor or login limits in one of them so the same job isn't done twice. See how Witen Blocker compares with Wordfence.
Do I need Warden, root access, or a paid plan?
No. Everything on this page runs inside WordPress for free. Paid plans add more connected sites and the full global blocklist; Warden adds firewall blocking on servers you run.
Will the scanner delete files?
No. It flags changed and suspicious files so you can decide what to do. It doesn't clean an infected site for you.
My site is behind Cloudflare or another proxy. Does it see real visitor addresses?
Cloudflare is recognised automatically. For other proxies, follow Get the client IP right so rules apply to visitors, not to your proxy.
What if I lock myself out?
Use a two-factor recovery code, or follow Recover login access.