Settings
Navigate to Settings → ScraperBlock in your WordPress admin menu. Settings are organised across five tabs: General, Advanced, Analytics, Logs, and License.
General Tab
Core protection controls and default bot-matching behaviour.
| Setting | Default | Description |
|---|---|---|
| Enable Protection | Yes | Master on/off toggle. Disabling this suspends all bot filtering instantly. |
| robots.txt Blocking | Yes | Adds Disallow directives for known bots to your robots.txt file. |
| .htaccess Blocking | No | Injects server-level block rules into .htaccess (Apache only). Faster than WordPress-level blocking as it fires before PHP. |
| noai / Meta Tags | Yes | Inserts <meta name="robots" content="noai, noimageai"> to instruct AI crawlers not to use your content for training. |
| Per-page Control | Yes | Enables a per-post/page toggle to bypass protection on individual pieces of content. |
| Allow AI Search Bots | No | Lets AI search and assistant bots (OAI-SearchBot, ChatGPT-User, PerplexityBot, Perplexity-User, MistralAI-User) read your pages so your store can appear in AI answers. AI training crawlers stay blocked. Applies to runtime blocking, robots.txt and .htaccess rules. |
| Basic Rate Limiting | Yes | Limits how many pages one visitor (IP + user agent) who isn't logged in can request per minute. Over the limit: 429 Too Many Requests. |
| Requests Per Minute | 120 | Maximum requests allowed per minute per IP before throttling kicks in. Recommended range: 30–120. Lower = stricter. |
| Custom User-agents | (empty) | Additional bot signatures to block, one per line. Extends the built-in default list. |
The built-in default bot list is shown below the Custom User-agents field. Use the search box to check if a signature is already covered before adding it manually.
Advanced Tab
Fine-tune detection methods, response controls, and operational safeguards.
| Setting | Default | Description |
|---|---|---|
| Behavioral Detection | Yes | Rate-limits requests with an empty user agent or one containing "headless". See Behavioral Detection. |
| Content Poisoning | No | Serves a plain-text decoy page (HTTP 200) to matched bots instead of blocking them with a 403. See Content Poisoning. |
| Honeypot Traps | Yes | Adds a hidden trap link to every page. An IP that follows it is blocked for an hour. See Honeypot Traps. |
| Geo-blocking | No | Blocks all visitors from the selected countries. Requires a country header such as Cloudflare's CF-IPCountry. See Geo Blocking. |
| Blocked Countries | (none) | Multi-select list of country codes to block. Only active when Geo-blocking is enabled. |
| WooCommerce Protection | No | Uses a separate rate limit for WooCommerce product and catalog pages and logs catalog blocks separately. Cart and checkout are excluded. See WooCommerce Protection. |
| WooCommerce Requests/Min | 120 | Per-minute limit for catalog pages, per visitor who isn't logged in. Replaces the basic limit on those pages. |
| IP Blocking & Whitelist | No | Enables manual IP blocklist and allowlist. Allowlist always takes priority. See IP Access Control. |
| Blocked IPs / CIDRs | (empty) | IPs or CIDR ranges to hard-block. One entry per line. Active when IP Blocking is enabled. |
| Whitelisted IPs / CIDRs | (empty) | IPs or CIDR ranges that bypass all ScraperBlock checks entirely. One entry per line. |
| Block Scheduling | No | Restricts protection to a daily time window. Outside the window all requests pass through normally. See Block Scheduling. |
| Schedule Start | 12:00 AM | Start of the active protection window (30-minute increments, site timezone). |
| Schedule End | 11:59 PM | End of the active protection window (30-minute increments, site timezone). |
| Real-time Threat Feed | Yes | Displays the most recent block events in the Analytics dashboard panel. See Threat Feed. |
| Email Alerts | No | Emails you when requests are blocked - at most one email every 10 minutes. See Email Alerts. |
| Alert Email Address | Site admin email | Where block alert emails are sent. Active when Email Alerts is on. |
| Multisite Support | On for multisite installs | Shares these settings across every site in the network. See Multisite. |
⚠️
Enabling Content Poisoning or Honeypot Traps may affect caching plugins. Test on a staging environment before enabling on a live store.
Analytics Tab
The Analytics tab is a read-only dashboard — there are no settings to configure here. It displays:
| Panel | Description |
|---|---|
| Total Blocks | Cumulative block count since installation |
| Blocks (24h) | Blocks in the last 24 hours |
| Unique IPs (7d) | Distinct IPs blocked in the last 7 days |
| Top Reason | Most common block reason |
| WooCommerce Insights | Woo-specific block count and top scraped product URLs |
| 7-Day Block Trend | Daily bar chart of block volume |
| Top Block Reasons | Breakdown by block reason (UA match, rate limit, honeypot, etc.) |
| Top Source IPs | Most frequently blocked IP addresses |
| Real-time Threat Feed | Latest block events as they happen (requires Threat Feed enabled) |
| Geo Map | Block count by country (requires Cloudflare or similar country header) |
Analytics data can be exported as a CSV from the Export Analytics CSV button in the tab header.
Logs Tab
The Logs tab is a read-only event table — there are no settings to configure here. Each log entry includes:
| Column | Description |
|---|---|
| Time | Elapsed time since the block event |
| Bot / User Agent | Matched signature or block reason |
| IP Address | Source IP of the blocked request |
| URL | Requested path that was blocked |
| Action | What happened - blocked (403) or served a decoy (content poisoning) |
The log keeps the 5,000 most recent events. Use Export CSV to download it, or Clear Logs to delete all entries.
License Tab
| Setting | Description |
|---|---|
| License Key | Paste your ScraperBlock Pro license key and click Activate License. An active license enables automatic plugin updates and support access. See License. |