Bot protection for WordPress in five simple modes. Every visitor is sorted into Humans, Suspicious, or Bots by the PureGuard 18-layer engine — then your mode decides: monitor, block bots, challenge the uncertain, allow humans only, or lock the whole site down. Branded challenge & block pages, a censorship-friendly VPN filter, and a live Security/Performance dashboard built in.
Download Free PluginPureGuard Performance sits between your traffic source and your landing page. It runs two independent detection phases before any visitor interacts with your content.
Layered server-side detection runs on every visit that reaches WordPress, before your page is built: multi-source IP reputation intelligence, bot UA signatures, datacenter ASN detection, Chrome version analysis, Sec-Fetch header validation, burst rate limiting, and more. In blocking modes, confirmed bots never see your page.
10 client-side integrity checks run in the real browser: Canvas fingerprint, WebGL renderer, AudioContext hash, math precision, hardware concurrency, timezone consistency, touch API presence, devtools detection, automated-browser flags, and runtime injection checks.
Filtered-tier visitors are served a lightweight verification page with SHA-256 proof-of-work + 10 browser integrity checks. Real browsers solve it in 1-3 seconds. Bots and automated browsers fail. Passed visitors get an HMAC-signed cookie valid for 1 hour.
Off, Monitor (watch and record only — never blocks a visitor), Medium (block confirmed bots), High (block bots + challenge suspicious), Strict (humans only), and Lockdown (emergency block-everyone — admins and search engines always excepted). One radio button, no unsafe combinations.
Audience behind censorship browsing via VPN? One toggle and visitors flagged only for VPN / proxy / hosting-network signals are never hard-blocked — they get the quick browser check instead. Humans pass in seconds; bots cannot. Real bot evidence still blocks.
Your logo, brand name, accent color, and dark/light theme on both the challenge and block pages. Blocked visitors see their IP, an incident ID, and an "I am human" report button — reports land on your dashboard. One-click previews before anything goes live.
Real-time engagement beacons fire at 10s, 30s, and 60s intervals. Scroll depth percentage, click events, and time-on-page are tracked and reported to your PureGuard dashboard. Prove your traffic quality with hard data.
In Monitor mode the check runs after your page has been sent, so readers never wait for it. Verdicts are cached per visitor, and if the PureGuard service is slow or unreachable the plugin lets visitors through — your site never goes down with it. Gate redirects and block pages are sent with no-cache headers, so a shared cache can never serve them to other readers.
All data flows to your PureGuard dashboard in real time. See tier breakdowns in Zone Quality, watch engagement metrics in Live Traffic, and track per-zone performance. WordPress admin shows a summary widget.
A visitor who passes the browser check once is never challenged or blocked again for the number of days you choose (up to 60) — even when their IP changes on mobile data or a VPN. The pass is signed and bound to that browser, and it is withdrawn automatically if that browser later shows real bot evidence. Off unless you turn it on.
Challenge and block pages can show only your site’s name: no vendor name, no plugin file paths in the page source, and neutral names for form fields and cookies. Your readers see your brand, nothing else.
Run the full campaign check on paid traffic and record every verdict per ad zone — without blocking or redirecting a single visitor. Use the first week to see which zones send bots, then exclude them at the ad network instead of turning visitors away.
Sites using Cloudflare’s Pseudo IPv4 are checked by each IPv6 reader’s real address, not the placeholder. Optionally trust Cloudflare’s own verified-crawler signal through a secret header, so search and social previews are never caught by look-alike user agents.
Quiet-log mode keeps visitor IPs and browser strings out of your server’s PHP error log. Deleting the plugin removes every setting and table it created — nothing is left behind in your database.
Traffic passes through two independent detection phases before reaching your content.
Visitor clicks your ad and lands on your WordPress site via PureGuard click URL
Layered server-side detection runs before your page is built. In blocking modes, confirmed bots never see your page.
10 integrity checks confirm the visitor is a real browser, not an automated browser or emulator.
Visitor is classified as Human, Suspicious, or Bot — your security mode decides who passes, who is challenged, and who sees the block page.
Every visitor gets one of three classifications; the security mode you pick decides what happens to each.
Trust score at or above your human line (default 5.5). Real device, real browser, clean network, consistent headers. Always allowed in every mode except Lockdown.
Not clearly human, not clearly bot. Passes in Medium, must solve the quick browser check (SHA-256 proof-of-work + 10 integrity checks, 1–3 seconds for real people) in High, and is blocked in Strict.
Confirmed by hard evidence: bot user-agents, IP blocklists, automation signatures, burst patterns, impossible browser fingerprints. Blocked in every enforcing mode — shown your branded block page or sent to a quarantine URL you choose.
Get up and running in under 2 minutes. No coding required.
Click the download button above to get the ZIP file. No account required to download.
In WordPress, go to Plugins → Add New → Upload Plugin. Select the ZIP file and click Install Now.
Activate the plugin, then navigate to Settings → PureGuard in your WordPress admin panel.
Enter your PureGuard workspace key (available in your account settings) and save. Protection starts immediately.
Built for performance-critical media buying environments.
These checks run on every visit that reaches WordPress, before your page is built.
Yes. The plugin connects to your PureGuard workspace via an API key. Create a free account to get your workspace key. The Starter plan includes 100,000 checks per month at no cost.
Not noticeably. In Monitor mode the check runs after your page has been sent, so readers never wait for it. In blocking modes each new visitor gets one quick server check and the verdict is cached; if the PureGuard service is slow or unreachable, visitors are let through. Cached pages served by your page cache or CDN are not touched at all.
No. The plugin only activates on pages loaded with PureGuard tracking parameters (pg_z and pg_src). Organic visitors from Google, social media, or direct links are completely unaffected. Search engine crawlers are never blocked.
No — turn on the censorship-friendly filter. Visitors flagged only for VPN / proxy / hosting-network signals are never hard-blocked; at most they see a quick automatic browser check that real people pass in seconds. Built for audiences in censored countries.
Yes — the PureGuard Live dashboard inside wp-admin shows a Security view (hourly charts, visitor mix, top blocked IPs, countries, reasons, live feed) and a Performance view (API latency, cache efficiency, blocked page-loads saved), powered by a local 30-day event log in your own database.
Any traffic source that can send visitors through a PureGuard click URL. This includes PopAds, RollerAds, HilltopAds, PropellerAds, ExoClick, ClickAdilla (including RTB), and any source that supports redirect tracking.
Yes. Install the plugin on as many sites as you need. Each site connects to the same PureGuard workspace key. All traffic data is aggregated in your dashboard.
Download the plugin, install in 2 minutes, and see your first traffic quality report within the hour.
Download Plugin Create Free Account