FAQ
Does behavioral detection affect site performance?
Barely. Behavioral detection only checks whether the user agent is empty or contains "headless", and only those requests are counted - normal visitors add no extra work.
Can I use geo-blocking and still allow VPN users from blocked countries?
Geo-blocking uses the country Cloudflare detects for the visitor's IP, so someone using a VPN appears to be in the VPN server's country. To let a specific person through, add their IP to the whitelist under IP Blocking & Whitelist. There is no VPN detection.
Does the threat feed share my site's data with WindCodex?
No. The threat feed is a panel showing your own site's recent block events. Nothing is sent to WindCodex or any other service.
How does content poisoning affect SEO?
It doesn't. The decoy page is only served to bots that match the blocklist. Real visitors and Googlebot (which isn't on the blocklist) always get your real pages.
Can I set different rate limits for different pages?
Partly. There are two limits: the general requests per minute, and a separate WooCommerce requests per minute for catalog pages (with WooCommerce Protection on). Per-page control can turn protection off entirely for a post or page. Both limits apply per visitor (IP + user agent) to everyone who isn't logged in; the defaults are far above normal browsing, so real visitors aren't affected.
Does Pro block different bots than Free?
No. Pro uses the same built-in blocklist as Free, including the Allow AI Search Bots option. Pro adds more ways to catch scrapers that don't identify themselves, such as behavioral detection, honeypot traps, IP blocklists and geo-blocking. The real-time threat feed is a dashboard panel of your site's recent block events; it doesn't change the blocklist.