Recommended approach: Change one group at a time, save, run a controlled test, and review Activity Logs before making another change.
Blocking and strike settings
| Setting | What it controls and how to use it |
|---|
| Strikes Before Blocking | How many confirmed suspicious visits an IP address may accumulate before access is denied. Valid range: 1-10. Default and recommended starting point: 3. Use 1–2 only for tightly controlled sites; use 4–5 when false positives are more costly than delayed blocking. |
| Strike Reset Time | How long strikes remain active after suspicious activity. Valid range: 1–168 hours. Default: 12. A new strike refreshes the active record. Shorten it for high-turnover public traffic; lengthen it for persistent scraping campaigns. |
| Blocked Visitor Experience | Access Denied Page displays Bot Guard’s response directly. Redirect to URL sends the visitor to the supplied address. Use a same-site HTTPS page and test caching and redirect loops before choosing Redirect. |
| Cache Compatibility Mode | Moves the detection entry point to a small browser-assisted WordPress request when a full-page cache bypasses PHP. Leave off unless Standard mode misses cached visits. Standard and Cache Compatibility modes do not run together. |
Detection and observation settings
| Setting | What it controls and how to use it |
|---|
| Browser Request Checks | Compares a claimed normal browser with the request information real browsers normally send. Strong missing-browser-information mismatches can contribute to a confirmed detection. |
| Basic browser information | Checks content negotiation information such as accepted content, languages, and compression. Default weight: 80 points. This is the strongest of the configurable request checks. |
| Page navigation consistency | Reviews browser navigation metadata for contradictions. Default weight: 20. It is supporting evidence and does not create a strike by itself. |
| Browser and connection consistency | Compares browser claims with protocol and connection-related request information. Default weight: 20. It is supporting evidence and does not create a strike by itself. |
| Browsing Pattern Checks | Briefly observes document-request timing and repetition, such as pages opened at perfectly regular intervals. It is short-lived context and does not create a strike by itself. |
| Browser Check | Runs a privacy-minimal first-party JavaScript proof without cookies, persistent storage, canvas, WebGL, or a saved fingerprint. A missing or invalid proof is recorded for review rather than automatically blocking the visitor. |
| Search Engine Verification | Uses forward-confirmed reverse DNS to verify visitors claiming to be major Google or Bing crawlers. Failed or unavailable DNS does not automatically block; the request continues through normal detection. |
Example: investigating a suspected scraperKeep the request-check weights at 80/20/20, enable Browsing Pattern Checks, and review several events. Do not increase every weight at once; first identify which signal consistently separates the scraper from legitimate visitors.
Analytics settings
| Setting | What it controls and how to use it |
|---|
| Google Analytics Tracking | Enables privacy-aware bot_detected and bot_blocked events. Raw visitor IP addresses are not included in analytics events. |
| Analytics Connection | Use Existing Site Setup pushes events through the site’s existing GA4/GTM data layer. Custom reveals fields for a separate GA4 Measurement ID or GTM Container ID. |
| GA4 Measurement ID | Optional custom ID in G-XXXXXXXXXX format. Leave blank to use data-layer delivery only. |
| GTM Container ID | Optional custom container in GTM-XXXXXXX format. Leave blank when the site’s existing container already handles Bot Guard events. |
Trusted traffic settings
| Setting | What it controls and how to use it |
|---|
| Trusted Automated Services | User-agent name patterns that bypass detection, one per line. Use a specific product name such as uptimerobot, not a broad word such as bot. |
| Trusted Service Groups | Preset groups for monitoring, CDN/security, SEO, analytics/marketing, security scanners, and development tools. Enable only groups the site uses because matching services bypass detection. |
| Hosting and CDN Addresses | Trusted reverse-proxy or CDN server IP/CIDR addresses, one per line. This allows Bot Guard to accept the forwarded original visitor address only from known infrastructure. Leave blank unless the provider gives you the exact ranges. |
Diagnostics and storage
| Setting | What it controls and how to use it |
|---|
| Diagnostic Mode | Shows additional troubleshooting detail and refreshes status information more often. Enable temporarily while investigating, inspect the result, then disable it. |
| Activity Logging | Keeps up to 500 recent Bot Guard decisions in Activity Logs. Entries may include IP addresses, pages, browser identification, reasons, signals, scores, and actions. Disabling it stops new user-facing activity entries; it does not clear existing strikes. |
System Health summary
The Settings introduction reports whether the cache script exists, trusted proxies are configured, cleanup is scheduled, when cleanup last ran, the most recent license connectivity check, and the current storage schema. Use this summary with WordPress Site Health when troubleshooting.