Detect suspicious automation
Review browser claims, request information, navigation patterns, and known automation signatures.
Website protection, made manageable
Stop unwanted bots before they become a business problem.
TMB Bot Guard gives WordPress owners clear bot detection, progressive blocking, trusted-service controls, and traffic intelligence—without turning everyday site management into a security project.
Free plan availablePrivacy-aware controlsBuilt for WordPress
Protection console● Protection active
3strike limit
12hreset window
0blocked now
Trusted crawler allowed
Verified service bypassed detection
Verified service bypassed detection
Suspicious request reviewed
Evidence recorded in Activity Logs
Evidence recorded in Activity Logs
Layered protection
Security decisions you can understand and control
Bot Guard combines strong request signals with progressive enforcement, while weaker observations remain visible for review instead of causing automatic blocks.
Block progressively
Use a configurable strike limit and reset window to stop repeat activity without overreacting to one unusual visit.
Manage trusted traffic
Allow verified search crawlers, monitoring tools, CDN addresses, and your own trusted services.
Work behind aggressive caches
Optional Cache Compatibility Mode performs the check after a cached page loads when WordPress is otherwise bypassed.
Investigate clearly
Activity Logs show why a decision occurred, the page involved, contributing signals, and the action taken.
Expand when needed
Add notifications, rate limiting, geographic analysis, reporting, integrations, and multi-site capabilities by plan.
Progressive strike enforcement
Review suspicious activity before it becomes a hard block.
Instead of denying access after one unusual request, Bot Guard records confirmed suspicious visits as strikes. The visitor initially retains access while the site owner gains evidence and time to decide how that traffic should be handled.
- Choose how many active strikes trigger automatic blocking
- Review the request, page, detection reason, and related activity
- Block persistent threats immediately when the evidence is clear
- Clear a false positive or whitelist legitimate traffic
- Let inactive strikes expire after the configured reset period
Measured enforcement
Example three-strike configuration
OWNER REVIEWExample three-strike configuration
1
Suspicious visit recordedAccess remains available; evidence enters the log.
Review2
Repeated activity observedThe owner can block, clear, or trust the address.
Review3
Strike limit reachedPersistent suspicious activity is automatically blocked.
BlockedBlock nowClear strikeWhitelist
Google Analytics 4 integration
See bot activity beside the traffic metrics you already use.
Bot Guard can send bot detections and blocks into GA4, helping you distinguish automated activity from real visitor behavior and understand which pages attract unwanted traffic.
bot_detectedbot_blocked- Use your existing GA4 or Google Tag Manager setup
- Send events to a separate GA4 property or GTM container
- Measure affected pages, strike counts, and security trends
- Use anonymized IP information instead of raw visitor addresses
- Send a test event before relying on the reporting
Traffic quality overview
Example GA4 event comparison
GA4 CONNECTEDExample GA4 event comparison
Visitor activityBot security events
1,842visitor sessions
126bots detected
34bots blocked
Designed for real WordPress sites
Start with sensible defaults. Fine-tune when your traffic calls for it.
The recommended three-strike, twelve-hour setup offers a balanced starting point. Built-in test tools, Site Health checks, and plain-language documentation help you validate protection before changing enforcement.
What you can manage
- Strike limits and reset time
- Blocked visitor experience
- Trusted IPs and automated services
- Browser and request consistency checks
- Google Analytics security events
- Premium protection modules by plan