WebDecoy Is Now on WordPress.org: One-Click Bot Protection

WebDecoy Bot Detection is now live on the official WordPress.org plugin directory. If you run WordPress, bot protection is now one search away: Plugins → Add New → search “WebDecoy” → Install → Activate. Protection starts immediately with sensible defaults — no API key, no configuration, no CAPTCHA.

Until today, installing WebDecoy meant downloading a zip from GitHub and uploading it manually. That worked, but it left updates as a manual chore and put the plugin outside the ecosystem where most WordPress users actually look for software. Directory listing fixes both.

What Directory Availability Changes

Automatic updates. WordPress now checks for new WebDecoy releases the same way it does for every other plugin. When we ship a detection improvement, your site gets it through the standard update flow — no watching GitHub releases.

Plugin review vetting. Every plugin in the directory passes review by the WordPress.org plugin team, and WebDecoy ships with full Plugin Check compliance. You are not taking our word for how the code behaves; it has been through the same review gate as everything else in the directory.

One-click install everywhere. Search from wp-admin, or from the command line:

wp plugin install webdecoy --activate

If you previously installed from a GitHub zip, the directory listing uses the same webdecoy plugin slug, so WordPress will offer updates from the directory going forward.

The Road to Approval Made the Plugin Better

WordPress.org’s guidelines are strict about privacy and self-containment, and the changelog since v2.0 tells that story:

• v2.2.1 bundled Chart.js (v4.5.1, MIT) directly into the plugin, eliminating every external CDN request from the dashboard. Nothing loads from third-party servers.
• v2.2.2 hardened PHP 7.4 compatibility and set the WordPress 6.1 baseline.
• v2.2.3 moved all CSS and JavaScript loading to WordPress’s own dependency APIs.

The result aligns exactly with how WebDecoy was designed to work: 100% local detection. The plugin makes zero external connections unless you explicitly add a WebDecoy Cloud API key. Detection data lives in your own database and cleans itself up after 30 days. Total added latency is under 5ms per request.

What You Get, Free

The directory version is the full, unrestricted plugin — the same freemium model we introduced in v2.0:

Server-side detection — user-agent and HTTP header analysis, good-bot verification via reverse DNS (Googlebot and 60+ legitimate crawlers are recognized automatically, so your SEO is never at risk), MITRE ATT&CK path analysis, rate limiting, and IP blocking with CIDR and IPv6 support.

Client-side detection — WebDriver and headless browser detection for Selenium, Puppeteer, and Playwright, behavioral analysis of mouse and scroll activity, and AI crawler identification for GPTBot, ClaudeBot, and PerplexityBot. We covered the detection internals in how the WebDecoy WordPress plugin detects bots.

Invisible challenges — SHA-256 proof-of-work runs silently in the visitor’s browser. Humans never see a challenge; bots running thousands of concurrent sessions pay a compute cost that breaks their economics.

Protection hooks — comment spam, login brute force, fake registrations, and WooCommerce checkout carding, all active on install.

Local dashboard — threat scoring, top blocked IPs, and 30-day trend analytics, rendered entirely from your own data.

The optional Cloud tier adds IP reputation via AbuseIPDB, VPN/proxy/Tor detection, GeoIP enrichment, and cross-site sync — but the core protection needs none of it.

Requirements

• WordPress 6.1 or higher (tested up to 7.0.2)
• PHP 7.4 or higher

That covers the overwhelming majority of active WordPress installations, including hosts still on older PHP builds.

Install It

The plugin is GPL-licensed, free, and fully functional out of the box.

• WordPress.org: wordpress.org/plugins/webdecoy
• GitHub: github.com/WebDecoy/wordpress-plugin

Search “WebDecoy” from your Plugins screen, click Install, click Activate. There is no step three.

Want threat intelligence, VPN detection, and cross-site management on top? See our plans.