外掛標籤
開發者團隊
原文外掛簡介
Bot attacks no longer come from one address. They come as swarms of thousands of addresses that each make one or two requests, so a tool that judges visitors one by one sees nothing wrong. Bot Storm Radar watches the crowd instead.
Every minute it counts how many different addresses visited, how many made only one request, how many loaded a stylesheet or a script the way a real browser does, and how evenly the browser names are spread. It turns that into a storm score, learns what normal traffic looks like on your site, and tells you in plain words whether a bot storm is running right now and why.
It also protects. It refuses requests for files only scanners ask for before WordPress builds a page, and a single address that keeps probing or asking for missing pages can be banned for a while. Address bans start in observe mode, where they are listed and nobody is refused, until you switch them on.
The radar
Swarm metrics every minute. Single-hit ratio, asset ratio, user-agent evenness, error pressure and endpoint concentration, combined into one storm score and gated by traffic volume.
Learned baseline. Over the first seven days the plugin learns the site’s normal number of distinct addresses per minute and its normal asset ratio, and shows them beside each threshold.
Storm states. Calm, warning, storm and cooling. Every transition is logged with the numbers that caused it and an explanation in words.
Alerts by plain-text email on warning, storm and all-clear.
Good-bot verification. DuckDuckBot is verified against its published address list. Googlebot, Bingbot, Applebot and Yandex are verified by reverse DNS plus forward confirmation once you switch on the Search bot check; until then their claims are counted as not checked and never banned. A user agent alone proves nothing.
The real visitor address behind a proxy. A forwarding header is believed only when the request arrived through Cloudflare, a local proxy or a proxy you declare. A spoofed X-Forwarded-For from an ordinary client is ignored.
Radar screen with the current state, the last 24 hours per minute, top classes, top keys, bot claims and the storm timeline, plus a dashboard widget.
The radar observes and reports. It never blocks a swarm. On a quiet site the numbers stay near zero and the state stays calm.
The protection
Refused early. The refusal runs as soon as WordPress has loaded its plugins, before the theme, the query or any page is built, and reads its rules from one stored option without an extra database query.
Probe refusal, on by default. A 403 for .env and other dot-files, copies of PHP files, configuration and log files, backups and dumps, other applications’ admin paths and .php files that do not exist. Files your web server serves itself never reach it.
Address bans, observe mode first. An address that sends 3 probes in 10 minutes or asks for 20 missing pages in a minute is banned for an hour, and for a day on a repeat. Administrators (for a day after they last used wp-admin), verified search bots, Cloudflare and declared proxies and a never-ban list are never banned.
Bans tab with every ban, its evidence and an Unban button, the bans that would have happened in observe mode, and search-bot claims waiting for verification.
A dry run over your own logs. wp bot-storm-radar replay --gate shows what would have been refused in your access logs before you switch bans on.
Also
Reads web-server access logs (nginx or Apache combined format) as separate sources from WP-CLI, for traffic that never reaches WordPress.
WooCommerce request classes (cart, checkout, wc-ajax) when WooCommerce is active.
Counters live in the persistent object cache or in APCu, with a transient fallback. One of the first two is strongly recommended.
External services
The plugin ships with two public address lists and uses them as they are. It makes no HTTP request to an outside service unless you ask it to: switch on Address lists on the Settings tab to download both lists once a day from WordPress cron, or click Download address lists now. A download sends nothing about your visitors. Like any HTTP request, it shows the service your server’s IP address and a user agent.
Cloudflare address ranges, from https://www.cloudflare.com/ips-v4 and https://www.cloudflare.com/ips-v6. The plugin needs them to tell a request that really came through Cloudflare from one that only claims to. The request carries the WordPress default user agent, which names your site’s address. The bundled copy is used until the first download and whenever a download fails. The service is provided by Cloudflare, see its terms and privacy policy.
DuckDuckBot address list, from https://duckduckgo.com/duckduckbot.json. The plugin needs it to verify visitors that claim to be DuckDuckBot. The request carries the user agent BotStormRadar/ followed by the plugin version. The bundled copy is used until the first download and whenever a download fails. The service is provided by DuckDuckGo, see its terms and privacy policy.
The DNS check of search bots is off by default as well. Switch on Search bot check on the Settings tab to verify visitors that claim to be Googlebot, Bingbot, Applebot or Yandex: the plugin then asks your server’s own DNS resolver for the host name of such an address, and looks that host name up to confirm it points back to the same address. Whether your resolver answers from its cache or asks other DNS servers, which then see the address, depends on your server’s configuration. With the check off, no lookup is made and those visitors are never banned. The same lookups run once when you ask for them on the command line with wp bot-storm-radar replay --gate --verify-bots. The plugin has no telemetry service.
