About this plugin
PureGuard is a simple, safe bot-protection plugin for WordPress. You pick one of six security modes — the plugin configures everything else for you. No confusing combinations, no accidental blocking.
Every visitor is sorted into one of three groups:
- Humans — proven real visitors (always allowed).
- Suspicious — not clearly a bot, but not clearly human either.
- Bots — confirmed bots.
The six modes
- Off (Disabled) — Completely inactive: never blocks, never calls the API, records nothing. Use when your traffic is already filtered upstream.
- Monitor (Watch only) — Checks and records every visitor to your Live dashboard so you can SEE your traffic and bot activity — but never blocks or challenges anyone. The safe first step before turning on blocking.
- Medium (recommended) — Confirmed bots are blocked. Humans and Suspicious visitors both pass freely. No challenge page.
- High — Confirmed bots are blocked and Suspicious visitors must pass a quick JavaScript browser check.
- Strict (Humans only) — Only proven humans get in. Bots AND suspicious visitors are blocked.
- Lockdown — Emergency mode: everyone sees the block page. Logged-in users and search engines are always excepted, so you never lock yourself out.
Censorship-friendly VPN filter
If your real audience browses through VPNs or proxies to escape censorship, turn on the censorship-friendly filter: a visitor flagged ONLY for VPN / proxy / hosting-network signals is never hard-blocked. In High mode they get the quick browser check instead (humans pass it, bots cannot). Visitors with real bot evidence are still blocked.
Branded challenge and block pages
Add your own logo, brand name, accent color, and dark or light theme. Customize the block-page heading and message, show blocked visitors their IP and an incident ID, and let real people report a mistake with one click (“I am human”). Preview both pages from the settings with one click before anything goes live.
PureGuard Live dashboard
A full statistics page with two views:
- Security — hourly traffic chart, visitor mix, top blocked IPs, top countries, top block reasons, visitor reports, and a live feed of the latest decisions.
- Performance — API latency (average and p95), cache efficiency, checks per hour, and the bot page-loads your server never had to render.
Data comes from a local, self-pruning event log in your own database (last 30 days). Nothing extra is sent anywhere.
Multilingual challenge page
The challenge page auto-detects the visitor’s browser language. English, Thai, Bahasa Indonesia, Vietnamese, and Burmese (Myanmar) are built in, and every line is editable from the settings page.
Engagement intelligence (off by default)
Optional and opt-in: when you turn it on, the plugin measures anonymous time-on-page and scroll signals so PureGuard can score traffic quality per site. Off by default — no tracking script is added unless you enable it. No personal data is collected.
External services
io) to score visits and manage protection:
- What is sent: visitor IP address, user agent, requested URL/campaign parameters and browser-provided headers of the request being checked; your site’s connector key authenticates the calls.
- When: on protected page requests (bot check), on settings/health checks, and when campaign delivery features are enabled.
- Why: the scoring and zone-intelligence engine runs server-side at PureGuard; the plugin only collects request evidence and applies the returned decision. If PureGuard is unreachable the plugin FAILS SAFE and lets visitors through.
- Service terms: https://pureguard.io/terms — Privacy: https://pureguard.io/privacy