Predax Security

JavaScript challenge, comment honeypot, browser fingerprint scoring, and request pattern analysis work together to detect and block headless bots — even ones with valid-looking IPs.

Score-based reCAPTCHA v3 on login and registration forms. Configurable threshold with fail-open on network errors so legitimate users are never locked out by a Google outage.

Reverse + forward DNS verification for 8 major bot operators (Googlebot, Bingbot, DuckDuckBot, YandexBot, and more). Flag or block spoofed user-agents pretending to be search engines.

Configurable trap URLs (wp-admin.php, xmlrpc-backup.php, and 6 other defaults). Any visitor that touches one is instantly blocked or blacklisted — they could only have found it by scanning.

One-click HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Harden your WordPress install against clickjacking, MIME sniffing, and cross-origin attacks.

Disable XML-RPC, hide the WordPress version from source, and disable the file editor — all from a single settings section. Close the most commonly abused attack surfaces without editing wp-config.php.

Configurable count and time window. Visitors hitting too many missing pages in a short window (a classic vulnerability-scanning signal) get temp-blocked or permanently blacklisted.

Click "Connect with Predax" in the setup wizard and the plugin links your site instantly — no API key to copy or paste. Uses OAuth2 Authorization Code flow with PKCE for secure authentication.

Guided 3-step setup appears on first activation. Pick a protection preset (Recommended / Strict / Monitor Only) and the plugin configures all the right defaults for you.

Signature-based WAF detects SQL injection, XSS, path traversal, file probes, command injection, and known scanner tools — before any authentication logic runs. Toggle independently from the risk score threshold.

When your site blocks a high-risk IP, that intelligence propagates to all other Predax-protected sites within seconds via the community score. Benefit from collective blocking without any extra setup.

[predax_lookup] renders an AJAX IP lookup widget on any page. [predax_badge] shows a "Protected by Predax" badge with live block count — useful for landing pages and footer trust signals.

Score every login attempt, new registration, and comment submission. Block or monitor IPs above your chosen risk threshold, with automatic blacklisting after failed login thresholds.

Optionally enable page-level protection to check every visitor's IP on site entry — not just logins. Results are cached per IP for one hour to avoid unnecessary API calls.

Per-signal Off / Monitor / Block radio controls for VPN, proxy, Tor, and datacenter IPs. Monitor mode logs the visit without blocking — useful for tuning before enforcing.

Extend IP blocking to the WordPress XML-RPC endpoint and REST API — common vectors for brute-force attacks and scrapers. Results are cached so API quota is not affected.

Replace the default WordPress error screen with a custom dark-themed block page. Set your own title, message, and a contact link so blocked users know how to reach you.

Prevent spam signups by rejecting or flagging registrations from known throwaway email providers (mailinator, yopmail, trashmail, and ~50 others). No external API call required.

Manage Predax from the command line: wp predax status, whitelist/blacklist add or remove IPs, view the threat log, and test any IP directly from your terminal.

Export your entire configuration to a JSON file and import it on another site. Useful for staging-to-production migrations or spinning up multiple protected WordPress installs.

Allow or deny access based on country or region. Blocking applies to all protected entry points: login, registration, comments, and visitor protection.

Scanner-based plugins

Wordfence, Solid Security, and similar

• Scan files for malware after it lands
• Match requests against firewall rule signatures
• React to known attack patterns