About this plugin
txt – and does it silently, so the bot never learns it was blocked.
Most WordPress security plugins block bad traffic with a 403 Forbidden page. That tells the bot operator “you’ve been caught” – so they change their fingerprint and come right back, and in the meantime a 403 still costs your server a full page load.
Lubber takes a different approach, adapted from a real six-figure-request bot-traffic investigation: matching requests get a normal 200 OK response with a tiny, harmless-looking static page instead – no error, no signal for the bot to react to, and no database query or theme render for your server to pay for. Because the decoy page never loads Google Analytics, AdSense, or any tracking script, bot hits also stop polluting your traffic reports and ad impressions.
What it does
- Maintained bot directory – a categorized, regularly-updated list of AI training crawlers, AI search/answer engines, SEO/marketing scrapers, and generic scrapers/scanners, each with a plain-English description of what it actually is. Untick anything you want to explicitly allow; new bots added in a future update are protected against automatically.
- Named-crawler blocklist – always blocks the bots above, plus any custom names you add yourself, regardless of referrer.
- Outdated-browser rule – optionally blocks requests claiming a Chrome version older than a threshold you set, even when the bot fakes a referrer.
- No-referrer detection, in three independently adjustable strengths – from a narrow “missing trailing slash” pattern up to a broad “any request with no referrer” rule for sites that know their traffic is overwhelmingly search-driven.
- Built-in protection for real crawlers – Google, Bing, and Apple’s crawlers are recognized two independent ways (by name and by their official published IP ranges) so a bot can never bypass detection just by copying a real crawler’s name.
- Exclusions for genuine visitors – Android traffic, AI-assistant referrals (ChatGPT/Perplexity/Claude/Gemini, which often strip the referrer for real human clicks), your own IP addresses, logged-in sessions, and WP-CLI are never touched.
- An activity log right in your dashboard – see what got blocked, by which rule, without needing server/SSH access. Includes a 14-day trend chart, a top-blocked-User-Agents and top-targeted-URLs report, and one-click CSV export.
- A built-in self-test tool – type in a User-Agent, referrer, and URL to see which rule (if any) would catch it, against your currently saved settings, with nothing logged and no real request needed.
- Everything is a toggle. No PHP editing required to enable, disable, or tune any rule.
Performance
The plugin hooks as early as a normal plugin can ( plugins_loaded, priority 0) so a blocked request exits before the main query, before your theme, and before most other plugins run. An optional, off-by-default “Early Loading Mode” goes further, intercepting before WordPress core itself finishes loading, for sites that want the absolute lowest possible cost per blocked request.
Privacy
This plugin never sends any data anywhere, and by default it never makes any outbound network request at all. Everything – the block rules, the IP allowlist, the activity log – stays in your own database, and the bundled Google/Bing/Apple crawler IP ranges are used as-is out of the box.
If you explicitly turn on “Auto-update crawler IP ranges” in the Advanced tab, the plugin makes up to three outbound requests per day – one each to Google, Bing, and Apple’s own published IP range lists – to keep those ranges current; no data about your site or its visitors is included in any of those requests. The Advanced tab also shows exactly which ranges are currently active and whether they’re the bundled defaults or a fetched copy.
External services
This plugin connects to Google, Bing, and Apple to download their official
crawler/bot IP address ranges, used to build a verified allowlist so
legitimate search engine crawlers are never blocked by mistake. This is
opt-in and off by default (“Auto-update crawler IP ranges” in the Advanced
tab); when enabled, it runs on a daily schedule.
No user or visitor data is sent to these services – each is a one-way
download of a public IP range file, not a data submission.
- Google: fetches https://www.gstatic.com/ipranges/goog.json
com/privacy
- Bing: fetches https://www.bing.com/toolbox/bingbot.json
com/en-us/privacystatement
- Apple: fetches https://search.developer.apple.com/applebot.json
com/legal/privacy/en-ww/