Bot Protection

What it does

WP Octo Bot Protection puts a challenge in front of a site's forms so that automated traffic never reaches WordPress itself. It is presented as part of Security, and lives on a site's Security page.

Turning it on

Bot Protection is included in some packages and not others; when it is not included, the site's Security page says which package would add it. Where it is included, the site can still switch it off on its own — the package decides what is offered, the site only ever narrows it.

What is protected

Each form the site runs is listed on its own — Login, Registration, Comments, Checkout — and switched on independently. A form the site does not currently have shows "Not installed on this site" instead of a switch.

Settings

• Difficulty — Easy, Medium or Hard, how hard the challenge is to pass.
• When a check fails — block the request, or let it through and log it.
• Hidden field trap — an additional check invisible to a visitor that only automated form-fillers trip.
• Requests per minute before rate limiting — the point past which further attempts from the same source are turned away regardless of the challenge.
• When it starts — as soon as the visitor ticks a box, when they first focus the form, as soon as the form loads, or only on submit.
• How it is shown — standard, a compact floating bubble anchored to the submit button, or invisible until it needs to speak up.
• Widget theme — always Light or Dark, or match the visitor's own system preference.
• Language — follow the site's own language, or a fixed one.
• Block the submit button until verified — on by default; the form itself keeps checking the challenge either way.

A change is sent to the site and confirmed there; if the site's own settings changed in the meantime, or it no longer considers Bot Protection entitled, the page says so in place of applying the change.

The 30-day counters

Below the settings, each protected form shows the last 30 days as a small chart and a table: how many challenges were issued, solved, refused, caught by the honeypot, or turned away by rate limiting. Nothing that identifies a visitor — no request, no IP address — is ever part of these counters. A site that has not reported yet shows "No data yet" in their place.