Which requests are checked
Bot Guard focuses on eligible front-end document requests. Static assets such as favicons, images, scripts, stylesheets, and similar resources are excluded so one page view does not become several strikes. WordPress administrators, trusted addresses, and recognized trusted services can bypass normal detection according to configuration.
Strong detections and supporting evidence
Known automation signatures, missing or very short browser identification, and strong contradictions from a tool pretending to be a normal browser can create a confirmed detection. Navigation metadata, protocol consistency, timing, and optional browser proof are supporting context unless combined with a strong rule.
| Result | Meaning |
|---|---|
| Allowed | No confirmed suspicious rule was triggered, or the visitor matched a trusted rule. |
| Observed | One or more weak signals were recorded for context, but no strike was created. |
| Strike added | A confirmed detection was recorded for the visitor’s IP address. |
| Blocked | The active strike count reached the configured limit, or an administrator blocked the address manually. |
Progressive enforcement
Each confirmed suspicious document visit can add one strike. At the configured limit, the address is blocked until its active strikes expire, an administrator clears them, or the address is whitelisted. This gives site owners evidence and a correction path before a hard block.
Strike expiration
The reset time is a period of inactivity, not a fixed daily reset. If no further strike occurs during that window, the record expires. New confirmed activity refreshes the active record’s timing.
Whitelist precedence
A whitelisted IP bypasses protection even when a blocked strike record remains. Removing the whitelist entry immediately restores enforcement if those strikes are still active. This makes temporary whitelisting useful during investigations without destroying evidence.
Standard and cache-compatible entry points
Standard mode evaluates the request before WordPress displays the page. Cache Compatibility Mode checks through a first-party browser request after a cached page appears. They share strike data and management tools but do not process the same page view together.