內容簡介
Witen Blocker 是一款強大的 WordPress 外掛，幫助用戶控制 AI 爬蟲的訪問權限、鎖定猜測密碼的機器人，並防止評論垃圾郵件。啟用後即刻生效，無需額外設置。
【主要功能】
• 自訂 AI 爬蟲訪問權限
• 鎖定密碼猜測者
• 阻擋已知的 WordPress 漏洞
• 防止評論垃圾郵件
• 每日掃描檢查文件變更
• 連接 Witen 帳戶獲取攻擊阻擋名單
外掛標籤
開發者團隊
② 後台搜尋「Witen Blocker — AI Crawler Control, Login Lockout & 2FA」→ 直接安裝（推薦）
原文外掛簡介
You decide who gets into your WordPress site. Choose which AI crawlers can read your content, lock out bots guessing your password, and stop comment spam. Protection starts the moment you activate it, with no account and no setup wizard.
Choose which AI crawlers read your site
Every recognized crawler gets its own allow or block switch. Welcome every AI crawler, block them all, or pick one by one. Nothing is blocked until you choose.
Witen Blocker recognizes GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Common Crawl, Meta-ExternalAgent, Amazonbot, and Applebot, plus the major search engines and ten uptime monitors, so a rule for one bot never catches the services you rely on.
robots.txt states your preference; Witen Blocker enforces it. A crawler you block gets an HTTP 403. Crawlers are matched by their published network ranges as well as their user agent, so a scraper pretending to be Googlebot doesn’t get Googlebot’s pass.
Lock out password guessers
Five failed logins in five minutes locks the address out for an hour, and you can change all three numbers. Add two-factor sign-in with any authenticator app and printable recovery codes, so a stolen password alone no longer opens your dashboard. Move the login page to an address only you know.
Block known WordPress exploits
Template traversal and comment exploit requests are refused before they reach the vulnerable WordPress code. No account needed.
Stop comment spam without a spam service
A hidden field and a timing check catch bots. No comment text ever leaves your site.
Catch unexpected file changes
A daily scan checks WordPress core against the official checksums, flags new and changed files, and looks for known malware patterns. Nothing is deleted or changed without you. Connected sites also receive maintained malware catalogs.
Block attackers before they reach you
Connect a free Witen account and your site gets blocklists built from attacks seen across every Witen site and server. An address caught attacking other sites is blocked on yours before it tries. Requests are checked against a local copy of the list, so no page load waits on Witen.
Connecting requires a Witen account and security-event sharing. Every local feature stays free, with no trial expiry. Free connected sites get a daily blocklist update. Paid plans add more sites and servers, other feed profiles, and off-site backup storage.
Shared hosting or your own server
On shared hosting, blocked requests get an HTTP 403 from WordPress, with no server access needed. On your own Linux server, add the Witen Warden agent and blocks move to the firewall, before the traffic ever reaches PHP.
Get started: activate Witen Blocker and open Witen > Dashboard to see what’s already on. Use Firewall > Bots and AI crawlers to choose which crawlers can visit, and Login to set up two-factor sign-in.
Setup guide | Witen plans | Support
External Services
Witen Collector
Connected features use https://collector.witenlabs.com. Enrollment exchanges your setup token and installation identity for a credential. Witen processes shared reports to identify distributed attacks and provide threat intelligence.
Background sync sends events and site details (listed below) and retrieves blocklists, bot identities, signed malware catalogs, Tor exit nodes, allowlists, service status, network statistics, and feed profiles. Profile changes send your selection and site identifier; IP lookups send the queried address. Block reports include the IP, rule, outcome, request context, and site identifier.
Malware samples: off by default. Setting WITEN_SEND_MALWARE_SAMPLES to boolean true in wp-config.php permits file-content uploads. Scans do not require them.
Off-site .htaccess backups: off by default. Enabling them permits encrypted file uploads, with checksum and size, and dashboard-requested restores. Witen can decrypt the files and keeps 10 versions. Restores validate content, make a local backup, and report results. Disabling the option stops uploads and remote restores; local backups remain available.
Witen terms | Witen privacy policy
WITEN_COLLECTOR_URL selects another collector if you operate one; its operator's policies apply. Explicitly configuring `WITEN_SOCKET_PATH` authorizes sharing with local Warden, whose configuration controls onward delivery. Detecting a socket alone does not enable sharing.
Cloudflare proxy ranges
Enrolled sites refresh https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/ during background maintenance to recognize trusted proxies. Offline sites use bundled ranges. Requests send ordinary HTTPS network metadata, not WordPress visitor events or account data.
Cloudflare terms | Cloudflare privacy policy
WordPress.org core checksums
Integrity scans request official hashes from https://api.wordpress.org/core/checksums/1.0/, sending your WordPress version, locale, and ordinary HTTPS network metadata. No visitor events, account data, or site content is sent.
WordPress.org privacy policy
The plugin does not remotely load executable code or frontend assets. Bundled bot references cause no remote requests or crawler DNS lookups. Collector connections use your DNS resolver. Background jobs and Apache rule checks call your own WordPress URLs.
Privacy Policy
Events stay local until enrollment or explicit Warden socket configuration. Earlier events are never uploaded retroactively. Connected intelligence requires event sharing. Deactivate the plugin to stop reporting from WordPress; a separately running Warden keeps its own reporting configuration.
What is shared: IP addresses; successful and failed logins; XML-RPC, comment, registration, and 404 events; request URLs, methods, User-Agent strings, referrers, and query information; and attempted usernames, which may be email addresses. Installation reports include site name and URL, WordPress/PHP/plugin versions, and a random installation identifier. An observed IP is not necessarily an attacker. Reports help identify distributed attacks, relate failed logins to later successful ones, and maintain blocklists.
Event reports exclude form bodies, post content, comment text, password fields, cookies, and session data. URLs and metadata can contain personal data. File samples and .htaccess backups are separate options, described above. WITEN_NO_TELEMETRY stops daily installation reports, but not connected security-event sharing.
Local storage: the delivery queue holds up to 500 events for seven days. Witen also keeps the latest 100 dashboard events and blocks, block and allow lists, and health counters. Rejected events and block-decision reports have separate diagnostic queues, each limited to 100 records or 1 MiB. Older records are removed at the limit; diagnostics otherwise remain until uninstall.
Deactivation preserves settings and existing .htaccess and Warden firewall rules. Uninstall removes Witen options, transients, scheduled actions, and database tables. Collector retention follows its operator’s privacy policy; request collector-side deletion from that operator.
