Title: PureGuard — Bot Protection & Performance Author: Pure Guard Published: 24.06.2026 Last modified: 04.08.2026 --- Шукати плагіни ![](https://ps.w.org/pureguard-performance/assets/banner-772x250.png?rev=3599719) ![](https://ps.w.org/pureguard-performance/assets/icon-256x256.png?rev=3583936) # PureGuard — Bot Protection & Performance Від автора [Pure Guard](https://profiles.wordpress.org/chanmyayaung/) [Завантажити](https://downloads.wordpress.org/plugin/pureguard-performance.6.2.0.zip) * [Деталі](https://uk.wordpress.org/plugins/pureguard-performance/#description) * [Відгуки](https://uk.wordpress.org/plugins/pureguard-performance/#reviews) * [Розробка](https://uk.wordpress.org/plugins/pureguard-performance/#developers) [Підтримка](https://wordpress.org/support/plugin/pureguard-performance/) ## Опис PureGuard is a simple, safe bot-protection plugin for WordPress. You pick **one** of six security modes — the plugin configures everything else for you. No confusing combinations, no accidental blocking. Every visitor is sorted into one of three groups: * **Humans** — proven real visitors (always allowed). * **Suspicious** — not clearly a bot, but not clearly human either. * **Bots** — confirmed bots. **The six modes** * **Off (Disabled)** — Completely inactive: never blocks, never calls the API, records nothing. Use when your traffic is already filtered upstream. * **Monitor (Watch only)** — Checks and records every visitor to your Live dashboard so you can SEE your traffic and bot activity — but never blocks or challenges anyone. The safe first step before turning on blocking. * **Medium (recommended)** — Confirmed bots are blocked. Humans and Suspicious visitors both pass freely. No challenge page. * **High** — Confirmed bots are blocked and Suspicious visitors must pass a quick JavaScript browser check. * **Strict (Humans only)** — Only proven humans get in. Bots AND suspicious visitors are blocked. * **Lockdown** — Emergency mode: everyone sees the block page. Logged-in users and search engines are always excepted, so you never lock yourself out. **Censorship-friendly VPN filter** If your real audience browses through VPNs or proxies to escape censorship, turn on the censorship-friendly filter: a visitor flagged ONLY for VPN / proxy / hosting- network signals is never hard-blocked. In High mode they get the quick browser check instead (humans pass it, bots cannot). Visitors with real bot evidence are still blocked. **Branded challenge and block pages** Add your own logo, brand name, accent color, and dark or light theme. Customize the block-page heading and message, show blocked visitors their IP and an incident ID, and let real people report a mistake with one click (“I am human”). Preview both pages from the settings with one click before anything goes live. **PureGuard Live dashboard** A full statistics page with two views: * **Security** — hourly traffic chart, visitor mix, top blocked IPs, top countries, top block reasons, visitor reports, and a live feed of the latest decisions. * **Performance** — API latency (average and p95), cache efficiency, checks per hour, and the bot page-loads your server never had to render. Data comes from a local, self-pruning event log in your own database (last 30 days). Nothing extra is sent anywhere. **Multilingual challenge page** The challenge page auto-detects the visitor’s browser language. English, Thai, Bahasa Indonesia, Vietnamese, and Burmese (Myanmar) are built in, and every line is editable from the settings page. **Engagement intelligence (off by default)** Optional and opt-in: when you turn it on, the plugin measures anonymous time-on- page and scroll signals so PureGuard can score traffic quality per site. Off by default — no tracking script is added unless you enable it. No personal data is collected. ### External services This plugin connects to the PureGuard service (https://pureguard.io) to score visits and manage protection: * What is sent: visitor IP address, user agent, requested URL/campaign parameters and browser-provided headers of the request being checked; your site’s connector key authenticates the calls. * When: on protected page requests (bot check), on settings/health checks, and when campaign delivery features are enabled. * Why: the scoring and zone-intelligence engine runs server-side at PureGuard; the plugin only collects request evidence and applies the returned decision. If PureGuard is unreachable the plugin FAILS SAFE and lets visitors through. * Service terms: https://pureguard.io/terms — Privacy: https://pureguard.io/privacy ## Скріншоти [⌊PureGuard Live dashboard — Security view⌉⌊PureGuard Live dashboard — Security view⌉[ PureGuard Live dashboard — Security view [⌊PureGuard Live dashboard — Performance view⌉⌊PureGuard Live dashboard — Performance view⌉[ PureGuard Live dashboard — Performance view [⌊Security mode selector (six modes)⌉⌊Security mode selector (six modes)⌉[ Security mode selector (six modes) [⌊Design & Pages — branding and block-page customization⌉⌊Design & Pages — branding and block-page customization⌉[ Design & Pages — branding and block-page customization [⌊The branded challenge page⌉⌊The branded challenge page⌉[ The branded challenge page [⌊The branded block page with incident details⌉⌊The branded block page with incident details⌉[ The branded block page with incident details ## Часті питання ### Will this block my real visitors? In Off mode, never. In Medium mode, only confirmed bots. In High mode, uncertain visitors may briefly see a JavaScript challenge. In Strict mode, suspicious visitors are blocked too — use it only when you want humans-only traffic. Lockdown blocks everyone except logged-in users and search engines. ### My readers use VPNs. Will they be blocked? Turn on the censorship-friendly filter (Security Mode tab). Visitors flagged only for VPN/proxy usage are never hard-blocked — at most they see a quick automatic browser check that real people pass in seconds. ### Do I need a PureGuard account? Yes. Add your PureGuard API key under Settings PureGuard. Get one at https://pureguard. io. ### Does it slow down my site? Verdicts are cached per visitor (default 1 hour), so the API is called at most once per visitor per cache window. Logged-in users and search engines are skipped. The Performance view of the Live dashboard shows you the exact latency and cache-hit numbers. ### Where is the traffic data stored? In a small table in your own WordPress database, pruned automatically to the last 30 days. You can turn the local log off in Settings General. ## Відгуки Для цього плагіна немає відгуків. ## Учасники та розробники “PureGuard — Bot Protection & Performance” — проект з відкритим вихідним кодом. В розвиток плагіну внесли свій вклад наступні учасники: Учасники * [ Pure Guard ](https://profiles.wordpress.org/chanmyayaung/) [Перекладіть “PureGuard — Bot Protection & Performance” на вашу мову.](https://translate.wordpress.org/projects/wp-plugins/pureguard-performance) ### Цікавитесь розробкою? [Перегляньте код](https://plugins.trac.wordpress.org/browser/pureguard-performance/), перегляньте [сховище SVN](https://plugins.svn.wordpress.org/pureguard-performance/) або підпишіться на [журнал розробки](https://plugins.trac.wordpress.org/log/pureguard-performance/) за допомогою [RSS](https://plugins.trac.wordpress.org/log/pureguard-performance/?limit=100&mode=stop_on_copy&format=rss). ## Журнал змін #### 6.2.0 * FIXED: Search engines, ad-verification and audience-measurement services are no longer treated as threats. Protection is for abuse — not for the legitimate services a site depends on. Ad verification and brand safety (IAS, DoubleVerify, Moat, Pixalate), audience measurement (comScore, Nielsen, Quantcast), feed readers( Google FeedFetcher, Feedly, Inoreader), ad-exchange page capture and uptime monitors are now always allowed. Blocking them never protected a site; it quietly cost publishers ad revenue and broke feed distribution. * NEW: More search engines recognised out of the box — Sogou, Naver, Seznam, Coc Coc, Qwant, Petal, Mojeek and the Internet Archive join Google, Bing, Yahoo, DuckDuckGo, Baidu, Yandex and Apple. * CHANGED: SEO and marketing crawlers (Semrush, Ahrefs, Moz, Majestic and similar) are now ALLOWED by default. They are not a security threat, so security no longer decides this for you. A new checkbox, “Block SEO & marketing crawlers”, lets you keep them out if you prefer. * UNCHANGED: AI training crawlers stay blocked by default (your articles are not free training data), and every genuine bot, automation framework and abusive client is blocked exactly as before. #### 6.1.0 * FIXED: On the publisher smart-route, one visit could trigger two protection decisions; every visit now receives exactly one server-side Guard decision (faster page delivery, cleaner analytics). * IMPROVED: Clearer product language across the settings screens — “Deep browser detection”, “Bot quarantine URL”, “Browser protection” — describing what each control does without internal jargon. * IMPROVED: Account statistics wording now consistently reflects PureGuard’s own first-party intelligence. #### 6.0.23 * NEW: Optional central protection policy for sites linked to a PureGuard account— the client-side browser-protection check can be managed centrally over a signed, authenticated connector channel. It fails safe: if the central service is unreachable or a response can’t be verified, browser protection stays ON. Sites that don’t use a PureGuard Connector are unaffected and keep their existing local setting. * SECURITY: Connector credentials are now stored encrypted at rest. * IMPROVED: Per-request diagnostic policy logging is emitted only when WP_DEBUG( or a dedicated debug flag) is enabled; normal production stays quiet. #### 6.0.22 * IMPROVED: Campaign render counting now fires the moment the page arrives (with a follow-up once the ad slot actually fills), so pop-under landings opened in a background tab are no longer missed by the counter. #### 6.0.21 * NEW: First-party render counter for campaign landing pages — a tiny same-origin beacon (immune to ad blockers) records that your money page really rendered and whether the ad slot filled. Stored only in a private file on your own site under a non-guessable name; nothing is sent anywhere. On by default for campaign visits only; switch it off in Settings. #### 6.0.20 * NEW: Optional “force render” for pop-under campaign landings (OFF by default). Some ad tags wait for the tab to gain focus before rendering; this treats the freshly opened background tab as already visible so the page and its ad render on load. Applies to campaign traffic only and never touches normal visitors. #### 6.0.19 * IMPROVED: The same-origin campaign gate now forwards the visitor’s real browser signals to PureGuard, so genuine humans are scored with full evidence instead of IP + user-agent alone. Fewer false quarantines of real visitors; bots gain nothing (the signals are browser-enforced). #### 6.0.17 * NEW: Same-origin campaign gate (opt-in, OFF by default) — filter your ad-campaign traffic right on the landing page instead of routing it through a separate gate URL first. Blocked ad zones still apply; if PureGuard is ever unreachable the gate fails open and lets the visitor through, never breaking your page. #### 6.0.16 * IMPROVED: The plugin records your workspace key once from your PureGuard account, so campaign intelligence beacons are correctly attributed to your workspace. #### 6.0.15 * NEW: Optional client-side browser-signal collector for campaign landing pages( OFF by default). Collects the same in-browser bot tells as the hosted PureGuard gate — same-origin, so nothing extra is loaded from third parties — and sends them to PureGuard for scoring. The detection logic itself stays server-side. #### 6.0.14 * SECURITY: The engagement beacon no longer places your API key in the page source. It now posts to your own site, which forwards it to PureGuard server-side — the key never reaches the browser. * NEW: The Performance view now shows real visitor engagement — average time on page, scroll depth and bounce rate — measured anonymously and stored only in your own site database (nothing is sent anywhere). Off by default; enable “measure engagement” to see it. A clear way to confirm the humans PureGuard lets through are genuinely engaged, while any bot that slips past shows near-zero time. * FIXED: The Performance view no longer counts failed or timed-out checks as “billed API calls” — they now have their own “API errors (fail-open)” figure, so your usage numbers are accurate. * IMPROVED: The “slowest checks” list now shows plain-English verdicts instead of internal codes. #### 6.0.13 * FIXED: The Live dashboard now counts UNIQUE VISITORS, not raw page-views. A single crawler hitting thousands of pages (mostly served from cache) was inflating the“ Bots” and “Checked” numbers many times over. The dashboard now shows the true number of unique visitors and bots, with total page-views shown as context — so the figures are honest and no longer alarming. #### 6.0.12 * SECURITY: The connector “campaign skip” is now an explicit opt-in setting, OFF by default. On a normal website every single visitor is now verified — a visitor can no longer skip the security check by adding tracking parameters to the URL. Media buyers who send PureGuard ad-connector traffic to their site can enable“ Media-buyer campaign skip” to avoid re-checking already-verified campaign traffic. #### 6.0.11 * FIXED: Campaign visitors from your ad connectors are recognized across their whole visit, not just the first click. Their follow-up page views (which drop the tracking parameters) no longer trigger a redundant security re-check — removing extra latency on paid landing pages. A short-lived cookie carries the “already- verified” status; bot-looking requests never get it. #### 6.0.10 * NEW: Campaign-aware Live dashboard — visitors arriving through your PureGuard ad-campaign landers (connector tracking URLs) are shown in their own “Campaign” bucket, separate from direct visitors. Their numbers now line up with your pureguard. io /live campaign stats. * IMPROVED: Campaign-referred visitors are no longer re-checked against the API( they were already verified upstream at the connector gate) — saves quota and removes per-visitor latency on landing pages. Bot-looking user agents never get this shortcut. * IMPROVED: Performance view labels now say exactly what is counted — local checks( incl. cache) vs API calls (server-billed) — so plugin totals and account totals are apples-to-apples. #### 6.0.9 * NEW: “Test key” button on the settings page — instantly confirm your API key works and see your plan and monthly usage. * HOUSEKEEPING: Deleting the plugin now fully cleans up after itself (removes its database table and settings). Deactivating still keeps your data. #### 6.0.8 * RELIABILITY: If the PureGuard service is ever unreachable, the plugin now detects it and instantly stops calling the API (no per-visitor delay) while allowing every visitor through — your site stays fast and open, never blocked. Protection resumes automatically when the service is back. * NEW: A clear status banner on the plugin pages tells you when protection is paused( service unreachable, or plan quota used up), so you always know the current state. #### 6.0.7 * FIX: “Allow VPN” and the censorship filter now tell the engine to skip VPN detection natively, so VPN readers are reliably allowed (previously some VPNs detected as proxies were still blocked). Real datacenter / TOR / public proxies stay blocked. Verified end-to-end with a real VPN visitor. #### 6.0.6 * IMPROVED: Plain-English labels in the Live dashboard (e.g. “Verified human”, “ Bot user-agent”, “Proxy network”) instead of raw engine codes. * IMPROVED: The Campaign tab now appears only if your account actually runs traffic connectors — pure-security sites see a clean, single-scope dashboard. #### 6.0.5 * PRIVACY: Engagement tracking is now OFF by default (opt-in). New installs are pure bot protection with no tracking script added; turn on Engagement in Settings General if you want time-on-page/scroll intelligence. * IMPROVED: The account/campaign view now shows only your traffic connectors — your site’s own security checks no longer appear mixed in as a “source.” #### 6.0.4 * NEW: Monitor mode — watch and record every visitor to your Live dashboard without ever blocking or challenging anyone. The safe first step: see your traffic for a few days, then turn on blocking once you trust it. (Off now means fully disabled— no blocking and no logging.) #### 6.0.3 * SECURITY: Site protection now uses a dedicated security endpoint, fully separated from the media-buying side — your WordPress site can never be affected by ad- traffic zone reputation. * IMPROVED: Clearer mode descriptions — Medium (fast server-side check) vs High( adds a browser check a bot cannot fake). #### 6.0.2 * NEW: Per-source breakdown in the account view — see every traffic source / connector with its own checked / accepted / blocked / accept-rate, so campaigns running side by side no longer blend into one number. * NEW: Source drill-down — pick a source (or click “view”) to scope the whole account dashboard to that one campaign. #### 6.0.1 * NEW: PureGuard Live now has two scopes — “This site” (visitors this plugin checked at your WordPress site) and “My PureGuard account” (every visitor across all your sites and traffic connectors). The account scope shows the same numbers as your pureguard.io/live dashboard, so the two never disagree. * IMPROVED: Clear labels explain which checkpoint each number comes from. #### 6.0.0 * NEW: Two more security modes — Strict (Humans only) and Lockdown (block everyone, admins and search engines excepted). * NEW: Censorship-friendly VPN filter — visitors flagged only for VPN/proxy/hosting signals are challenged instead of hard-blocked, for audiences that browse via VPN to escape censorship. * NEW: PureGuard Live — a full statistics dashboard with Security and Performance views: hourly charts, visitor mix, top blocked IPs/countries/reasons, live feed, API latency and cache efficiency. Powered by a local, self-pruning 30-day event log. * NEW: Branded gate pages — custom logo (Media Library picker), brand name, accent color, dark/light theme on both the challenge and block pages, with one-click admin previews. * NEW: Customizable block page — heading, message, visitor IP + incident ID + time display, and an “I am human” report button; reports appear on the Live dashboard. * NEW: Custom success message and optional redirect after a passed browser check. * CHANGED: Each site now reports to PureGuard intelligence under its own domain as the traffic source (previously a shared “WORDPRESS” source), so your site gets its own reputation. * FIX: Internal version constant and readme stable tag aligned. #### 5.0.7 * IMPROVED: Off mode now returns before any API call — zero added latency when monitoring is all you want. #### 5.0.4 * NEW: “Allow AI training crawlers” toggle (off by default). Search engines and social crawlers are always allowed. * CHANGED: “Allow VPN” now applies to VPNs only — open / datacenter / TOR proxies stay blocked. * IMPROVED: Plain-language labels (Humans / Suspicious / Bots) throughout. #### 5.0.3 * IMPROVED: The plugin forwards the visitor’s browser headers (Sec-Fetch, client- hints, language) to the detection API for accurate trust scoring. #### 5.0.2 * NEW: “Allow VPN / proxy visitors” toggle. #### 5.0.1 * NEW: Burmese (Myanmar) challenge language. Default trust threshold aligned to 5.5. #### 5.0.0 * NEW: One security mode selector (Off / Medium / High) replacing the v4 multi- dropdown setup, per-site zone identity, multilingual challenge page, stats tab, fail-open API behavior. #### 4.0.1 * Compliance: challenge CSS/JS moved into enqueued assets per WordPress.org review. #### 4.0.0 * BREAKING: prefixes renamed to `pgperf_`. JS challenge with SHA-256 proof-of-work and browser integrity checks. #### 3.0.0 * Three-tier traffic classification. #### 2.0.0 * WAF security layer via the PureGuard detection engine. #### 1.0.0 * Initial release. ## Мета * Версія **6.2.0** * Останнє оновлення **3 дні тому** * Активних встановлень **Менше 10** * Версія WordPress ** 5.6 або вище ** * Tested up to **7.0.3** * Версія PHP ** 7.4 або вище ** * Мова * [English (US)](https://wordpress.org/plugins/pureguard-performance/) * Позначки * [bot detection](https://uk.wordpress.org/plugins/tags/bot-detection/)[firewall](https://uk.wordpress.org/plugins/tags/firewall/) [security](https://uk.wordpress.org/plugins/tags/security/)[traffic quality](https://uk.wordpress.org/plugins/tags/traffic-quality/) [WAF](https://uk.wordpress.org/plugins/tags/waf/) * [Розширений перегляд](https://uk.wordpress.org/plugins/pureguard-performance/advanced/) ## Оцінки No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/pureguard-performance/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/pureguard-performance/reviews/) ## Учасники * [ Pure Guard ](https://profiles.wordpress.org/chanmyayaung/) ## Підтримка Є що сказати? Потрібна допомога? [Перейти в форум підтримки](https://wordpress.org/support/plugin/pureguard-performance/)