Troubleshooting
A Legitimate Tool or Visitor Is Blocked
Check the log
Open the Logs tab and find the request - the reason shows which check blocked it (for example blocked_user_agent, behavioral_detection, ip_blocked or geo_blocked).
Allow the IP
Turn on IP Blocking & Whitelist and add the IP to the whitelist. Whitelisted IPs skip all checks.
Check behavioral detection
Tools that send no user agent are rate-limited by Behavioral Detection. Whitelist them or give them a user agent.
Honeypot Isn't Catching Anything
The trap link is added to the footer through the wp_footer hook. If your theme doesn't call wp_footer(), the link isn't output - view the page source (logged out) and look for aibs_trap. Well-behaved crawlers ignore the link on purpose, so an empty honeypot log can also just mean no aggressive scraper has visited yet. See Honeypot Traps.
A Visitor Was Blocked for an Hour
Check the Logs tab for honeypot_trap entries from their IP. Something on that IP followed the hidden trap link - often a browser extension or tool that prefetches every link. Add the IP to the allowlist under IP Blocking & Whitelist; the block also clears by itself after an hour.
Visitors Get "429 Too Many Requests"
The visitor went over Requests Per Minute (or WooCommerce Requests/Min on catalog pages). Raise the limit, or add trusted IPs (for example your own monitoring tools) to the allowlist. Logged-in users are never rate limited.
Geo-Blocking Not Working
Check for Cloudflare
Geo-blocking needs Cloudflare's CF-IPCountry header. If your site isn't behind Cloudflare (with IP Geolocation on), no country is detected.
Check the Geo Map
If the Analytics tab shows "No geo data yet", the header isn't reaching your site.
Test with a VPN
Visit from a blocked country and look for a geo_blocked entry on the Logs tab.
Too Many Alert Emails
Email Alerts sends at most one email every 10 minutes, with a count of the blocks in between. If that's still too many, turn it off and use the Analytics tab for monitoring.
Analytics Shows No Data
Check the log
Analytics is built from the log on the Logs tab. If the log is empty (or was cleared), the dashboard is empty too.
Test with a known bot
Request a page with a blocked user agent - for example curl -A "GPTBot" https://yoursite.com/ - and check that a 403 is returned and logged.
Check page caching
A full-page cache can serve pages before ScraperBlock runs. Exclude bot user agents from caching.