{
    "title": "Bot traps for WordPress",
    "seo_title": "Block Bad Bots and Vulnerability Scanners on WordPress",
    "h1": "Bot traps for WordPress",
    "description": "See which bots probe your WordPress site for /.env, /administrator/ or /phpmyadmin, then ban the persistent ones automatically with WP Masquerade Pro.",
    "lead": "A normal visitor never opens /administrator/, /.env, or /phpmyadmin on your site. WP Masquerade counts these bot requests and, with Pro, bans the ones that keep trying.",
    "language": "en",
    "locale": "en-US",
    "type": "page",
    "url": "https://www.wp-masquerade.com/features/bot-traps/",
    "canonical": "https://www.wp-masquerade.com/features/bot-traps/",
    "markdown": "https://www.wp-masquerade.com/features/bot-traps/index.md",
    "json": "https://www.wp-masquerade.com/features/bot-traps/index.json",
    "published": "2026-10-27T23:16:53+00:00",
    "modified": "2026-11-05T20:53:44+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Bot traps for WordPress",
            "url": "https://www.wp-masquerade.com/features/bot-traps/",
            "markdown": "https://www.wp-masquerade.com/features/bot-traps/index.md",
            "json": "https://www.wp-masquerade.com/features/bot-traps/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Pièges à robots pour WordPress",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/pieges-a-robots/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/pieges-a-robots/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/pieges-a-robots/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Trampas para robots en WordPress",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/trampas-para-robots/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/trampas-para-robots/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/trampas-para-robots/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Bot-Fallen für WordPress",
            "url": "https://www.wp-masquerade.com/de/funktionen/bot-fallen/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/bot-fallen/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/bot-fallen/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Trappole per bot su WordPress",
            "url": "https://www.wp-masquerade.com/it/funzionalita/trappole-per-bot/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/trappole-per-bot/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/trappole-per-bot/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Armadilhas para robôs no WordPress",
            "url": "https://www.wp-masquerade.com/pt/recursos/armadilhas-para-robos/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/armadilhas-para-robos/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/armadilhas-para-robos/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Robotvallen voor WordPress",
            "url": "https://www.wp-masquerade.com/nl/functies/robotvallen/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/robotvallen/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/robotvallen/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Bot traps for WordPress"
        },
        {
            "level": 2,
            "text": "What the traps do"
        },
        {
            "level": 2,
            "text": "Why it helps"
        },
        {
            "level": 2,
            "text": "Free or Pro"
        },
        {
            "level": 3,
            "text": "In the free version Free"
        },
        {
            "level": 3,
            "text": "With WP Masquerade Pro Pro"
        },
        {
            "level": 2,
            "text": "Configuring banning (Pro)"
        },
        {
            "level": 2,
            "text": "Personal data"
        },
        {
            "level": 2,
            "text": "Limitations and precautions"
        },
        {
            "level": 3,
            "text": "Related reading"
        },
        {
            "level": 2,
            "text": "Start free, upgrade to Pro when you’re ready"
        }
    ],
    "body": "## What the traps do\n\nThe **Bot traps** module spots requests for URLs that don’t exist on your site but that attack bots go looking for. They fall into three families:\n\n- **Vulnerabilities of the imitated software**: for example `/administrator/` or `?option=com_` for Joomla!, `/user/login` for Drupal;\n- **Sensitive file scanners**: `/.env`, `/phpmyadmin`, `.sql` or `.bak` backups;\n- **Closed WordPress URLs**: `wp-login.php`, `xmlrpc.php`, `/?author=` (with Pro), once the other modules have hidden them.\n\nThese URLs always return “[page not found](https://www.wp-masquerade.com/glossary/404-error/)”, so the traps have no effect on your visitors. A page that actually exists is never counted, nor is a missing file under your own aliases, and logged-in visitors are never counted either.\n\n## Why it helps\n\nTraps surface activity that usually gets buried in server logs. Combined with [imitation](https://www.wp-masquerade.com/features/cms-imitation/), they show that bots are hunting for vulnerabilities your site doesn’t have. With Pro, they become a way to automatically shut out the most persistent bots.\n\n## Free or Pro\n\n### In the free version Free\n\n- Bot counts by family\n- Stats for the last 7 days, the last 30 days, and all time\n- Most targeted URLs\n- Counter reset\n\n### With WP Masquerade Pro Pro\n\n- Automatic banning after N traps (3 recommended: a human never falls into three traps)\n- Detailed 30-day log: date, targeted URL, network (truncated IP), tool used\n- Fake Joomla! (/administrator/) and Drupal (/user/login) login pages that lead nowhere\n- New trap patterns delivered through the [signature feed](https://www.wp-masquerade.com/features/signature-feed-and-updates/)\n\n![Bot traps tab: counters for 7 days, 30 days and all time, most targeted addresses and automatic banning settings](https://www.wp-masquerade.com/media/2026/10/admin-pieges.webp)\n\n*Trap counters (free) and automatic banning (Pro).*\n\n## Configuring banning (Pro)\n\n| Setting | Values |\n| --- | --- |\n| Ban after how many traps | 0 = never; 3 recommended |\n| Ban duration | 1 to 720 hours |\n| IP addresses never banned | one per line; your administrator address is already protected automatically |\n\nA banned bot gets “Forbidden” across the entire site. The **Lift all bans** button clears everything, and **Unblock me** releases your current IP address if you blocked yourself by mistake.\n\n## Personal data\n\nThe Pro log keeps, for 30 days at most, the date, the requested URL, the truncated IP address (IPv4 /24, IPv6 /48), and the tool used. Banning relies on a hash (HMAC) of the IP address, never the plain address. On a fake admin page, the log records that a username was entered, without storing what was typed. This data stays on your site: mention it in your privacy policy (legitimate interest: security).\n\n## Limitations and precautions\n\n- Pages already in cache are still served to a banned bot: banning applies to requests that reach WordPress.\n- Behind a proxy or [CDN](https://www.wp-masquerade.com/glossary/cdn/), ask your host to restore visitors’ real IP addresses; otherwise, every visitor shares the proxy’s address.\n- Traps observe and shut out bots; they don’t replace a network firewall or protection against distributed attacks.\n\n**Behind Cloudflare**, Pro bans bots’ real IP address, not the address of a Cloudflare server shared with your visitors. See [Cloudflare support](https://www.wp-masquerade.com/features/cloudflare/).\n\n### Related reading\n\n- [Imitating another CMS](https://www.wp-masquerade.com/features/cms-imitation/)\n- [Login attempt limiting](https://www.wp-masquerade.com/features/login-attempt-limiting/)\n- [Email alerts and weekly report](https://www.wp-masquerade.com/features/email-alerts/)\n- [Signature feed and updates](https://www.wp-masquerade.com/features/signature-feed-and-updates/)\n- [Cloudflare support](https://www.wp-masquerade.com/features/cloudflare/)\n- [WordPress anti-spam: what WP Masquerade blocks](https://www.wp-masquerade.com/wordpress-anti-spam/)\n\n## Start free, upgrade to Pro when you’re ready\n\nThe free version already hides WordPress, moves the login page, blocks XML-RPC and counts bots. Pro locks down logins, renames file URLs and monitors your sites for you: known vulnerabilities, core integrity, activity log, email alerts and the update status of all your sites in your member area. From €59 per year excl. tax, far less than the cleanup offers whose prices we checked. [Compare the costs](https://www.wp-masquerade.com/pricing/#cout-piratage).\n\n[See Pro pricing](https://www.wp-masquerade.com/pricing/)\n\n[Download the free version](https://www.wp-masquerade.com/download/)",
    "format": "application/json"
}