Comprehensive Protection for
Your WordPress Site
Automatic blocking of vulnerability scanners, brute force attacks, AI scraping, and DDoS. Over 20 detection methods. Install, activate — protection works.
What CyberPulse Security Protects Against
Your WordPress site is attacked every day by bots, scanners, and hackers. The plugin blocks threats automatically.
Bots & Vulnerability Scanners
Automated programs scan sites 24/7 for vulnerabilities: wp-login.php, xmlrpc.php, .env, .git, wp-config.php. The plugin detects them by User-Agent, HTTP headers, and behavior — blocking them before they reach your files.
Brute Force Attacks
Hackers try thousands of passwords per minute on wp-login.php and XML-RPC. The plugin tracks login attempts and permanently blocks the entire /24 subnet when limits are exceeded.
AI Content Scraping
GPTBot (OpenAI), Claude (Anthropic), PerplexityBot, Google-Extended, Bytespider and other AI bots collect your content for model training. The plugin recognizes and blocks them without affecting legitimate search engines.
SQL Injection & XSS Attacks
Attackers try to inject malicious code through URL parameters and forms. The plugin checks all incoming requests for SQL injection and XSS patterns, blocking attacks before WordPress processes them.
DDoS Attacks & Flooding
Mass requests overload your server and take down your site. Three protection layers: Rate Limiting, DDoS Protection, and Anti-Slowloris.
Content Theft
Your articles, images, and code are stolen by competitors and automated parsers. Protection against text selection, right-click, hotkeys (Ctrl+C, Ctrl+U), image dragging, and iframe embedding.
Hidden Malware Files
Viruses and backdoors disguise as legitimate files. The malware scanner checks PHP, JS, INC, and TXT files daily, finding hidden files, eval-injections, and base64-decoders.
WordPress Data Leakage
Default WordPress exposes version, usernames, plugin and theme lists. The plugin hides system files, removes version from HTML and script URLs, blocks direct user enumeration via REST API.
Your content is being stolen by AI bots — right now
Every day, dozens of AI bots scan your site to steal content for AI model training. You don't even know about it.
How Protection Works
Every request passes through 4 check layers in milliseconds — before WordPress loads. Bots are filtered out at the very first layer and never consume server resources.
Request
A visitor opens a page
IP Filter
Whitelist · Permaban · Temp block
Request Analysis
User-Agent · Headers · Referer · AI signatures
Behavior
Rate limit · Behavior · Threat Intel
WordPress loads, page is served
403 page + "human or bot" check
All of this happens in <1 millisecond. Blocked bots never consume server resources — WordPress does not even load.
Version Comparison
Free version — powerful basic protection sufficient for most sites. PRO adds advanced features for maximum security.
| Feature | 🆓 Free | 🛡️ PRO |
|---|---|---|
| 🤖 Bot Blocking by User-Agent | ✅ | ✅ |
| 🚫 HTTP/1.0 Scanner Blocking | ✅ | ✅ |
| 🔍 Suspicious Headers Check | ✅ | ✅ |
| 🛡️ Brute Force Protection (wp-login, XML-RPC) | ✅ | ✅ |
| 📁 WordPress System Files Hiding | ✅ | ✅ |
| ⏱️ Rate Limiting (Flood Control) | ✅ | ✅ |
| ✅ IP Whitelist (Manual + Auto) | ✅ | ✅ |
| 📧 Email Attack Notifications | ✅ | ✅ |
| 🗑️ Automatic Log Cleanup | ✅ | ✅ |
| 📊 Admin Dashboard Security Widget | ✅ | ✅ |
| 🔒 Force HTTPS | ✅ | ✅ |
| 🧪 Automatic Security Test (17 Tests) | ✅ | ✅ |
| 🤖 AI Scraping Protection | ✅ | ✅ |
| 🛡️ XSS & Hidden Files | ✅ | ✅ |
| 🔗 Referer Check | ✅ | ✅ |
| 🚫 404 Detection (Vulnerability Scanners) | ✅ | ✅ |
| 🔵 URL Firewall | ✅ | ✅ |
| 🚫 User-Agent Blacklist | ✅ | ✅ |
| 📋 Event Log (Audit) | ✅ | ✅ |
| 🔒 Secure Cookies | ✅ | ✅ |
| 🔓 PRO Features | ||
| 🧠 Behavioral Visitor Analysis | ❌ | ✅ |
| ☁️ Cloudflare Turnstile (Smart Captcha) | ❌ | ✅ |
| 🔐 Two-Factor Authentication (2FA) | ❌ | ✅ |
| 🛡️ DDoS Protection (Advanced) | ❌ | ✅ |
| 🌍 Geo-Blocking by Country | ❌ | ✅ |
| 📝 Content Copy Protection | ❌ | ✅ |
| 📊 File Integrity Monitoring | ❌ | ✅ |
| 🔍 Malware Scanner | ❌ | ✅ |
| 🛡️ Content Security Policy (CSP) | ❌ | ✅ |
| 🚫 Advanced SQL Injection Protection | ❌ | ✅ |
| 🛡️ WAF — request-level attack protection | ❌ | ✅ |
| 📤 File upload protection | ❌ | ✅ |
| 📧 Weekly Security Report | ❌ | ✅ |
| 🔌 REST API Rate Limiting | ❌ | ✅ |
| 💾 File System Protection | ❌ | ✅ |
| 🕷️ SEO Crawler Blocking | ❌ | ✅ |
| 📧 Antispam (comments, registrations) | ❌ | ✅ |
| 🌐 Pulse Sync — global threat network | ❌ | ✅ |
| 👻 Ghost IP Protection | ❌ | ✅ |
| 🛡️ Threat Intelligence (Global Database) | ❌ | ✅ |
Not sure you need PRO? Start with the free version — it already blocks AI bots and brute force.
🆓 Download Free VersionPRO Features in Detail
Each feature is developed based on analysis of real WordPress attacks.
🧠 Behavioral Visitor Analysis
Heuristic analysis of on-site behavior. Detects bots masquerading as real browsers with correct User-Agent and all headers — but behaving unnaturally. Analyzes page speed, URL sequences, GET/POST ratios. Configurable trigger threshold.
☁️ Cloudflare Turnstile
Smart "human or bot" check by Cloudflare. No captcha in 90% of cases. Free up to 1,000,000 checks/month. No domain transfer or DNS changes needed.
🔐 Two-Factor Authentication (2FA)
Extra login security layer for WordPress admin. Supports Google Authenticator, Authy, Microsoft Authenticator. Even with stolen password — impossible to login without the code.
🌍 Geo-Blocking
Block site access by country based on IP geolocation. Blacklist and whitelist modes. 195 countries in database. Redirect option available.
📝 Content Copy Protection
Disable text selection, right-click, hotkeys (Ctrl+C, Ctrl+U, Ctrl+S, F12). Auto source link on copy. Iframe protection. Player compatibility via data-cs-allow.
📧 Weekly Security Report
Automated weekly security summary sent to administrator email: attack count, top offenders, weekly statistics. Configurable day and time.
🔍 Malware Scanner
Daily scan of PHP, JS, INC, TXT files. Detects eval-injections, base64-decoders, hidden files. Whitelist for files and exclusion folders. "This is safe" button for false positives.
🛡️ DDoS Protection & Anti-Slowloris
Three layers of application-level protection (Layer 7). Configurable thresholds. Slow connection blocking. Automatic permanent subnet ban.
🛡️ Threat Intelligence
Global malicious IP database from 2 sources (blocklist.de, Tor exit nodes). Auto-updating. Instant /24 subnet block. Built-in fallback list when services are unavailable.
📊 File Integrity Monitoring
Critical WordPress file monitoring every 6 hours. Email notifications on changes. Change history in admin panel.
🌐 Pulse Sync — global threat network
Unique collective protection technology. When any CyberPulse PRO site blocks a malicious IP, all other sites automatically block it within 15 minutes. Blocking only triggers if 2+ sites confirm the attack. The more sites in the network, the stronger each site's protection.
👻 Ghost IP Protection
Blocks IP addresses without an Autonomous System Number (ASN) and reverse DNS record (rDNS). Most legitimate networks always have at least one of these identifiers. Bots and scanners often use unregistered IPs. Checks ASN via ip-api.com, performs rDNS lookup. Known networks (AWS, Google Cloud, Cloudflare) are auto-whitelisted.
🕷️ SEO Crawler Blocking
Blocks SEO auditors (Ahrefs, Semrush, Moz, DataForSEO, Screaming Frog) and vulnerability scanners at the .htaccess level — before PHP loads. They consume gigabytes of traffic and hammer your server with thousands of requests without bringing a single visitor. Flexible allowlist: keep only the services you actually use.
📧 Spam Protection
Multi-layer protection for comments and registrations: honeypot trap, submission speed check, link limit, known spam words, forbidden names, temporary emails, Spamhaus DNSBL, and a 5-comment-per-10-minutes limit per IP. Spam bots are filtered out, real readers pass through.
🛡️ WAF — request-level protection
Inspects URLs, GET/POST parameters and JSON/XML bodies before WordPress handles them. Blocks path traversal, LFI, XSS and dangerous PHP function calls. Helps when a plugin or theme has a vulnerability and no update is available yet.
📤 File upload protection
Blocks dangerous extensions, double extensions, MIME mismatches and malicious code in SVG. Prevents shell uploads through forms and the media library even if an upload plugin is vulnerable.
Technologies others don't have
While standard plugins protect your site alone, CyberPulse PRO uses a global network and IP "passport" verification.
Pulse Sync
When a bot attacks one CyberPulse PRO site, the whole network instantly knows. We share attacking IP databases in real-time to block threats before they reach your server.
Ghost IP Protection
90% of plugins can be fooled by faking a User-Agent (acting like Google Chrome). But CyberPulse PRO looks at the core — the IP "passport" — cutting off suspicious networks.
Why Choose CyberPulse Security
Instant Protection
The plugin works right after activation. No configuration needed — all features are enabled by default with optimal settings.
Transparency
You see every blocked IP, the reason for blocking, and the attacker's country. Full logs and real-time statistics.
Regular Updates
New features are added every month. The plugin is constantly being improved.
10 Languages
Interface translated into Russian, English, German, French, Italian, Spanish, Portuguese, Chinese, Japanese, and Korean.
Pricing
Payment via secure payment system. License key sent to your email immediately after payment. Check your Spam folder! — emails sometimes end up there.
For those who want to try
- ✅ All PRO features
- ✅ Plugin updates for 30 days
- ✅ Email support
Save 58% — $70 cheaper
- ✅ All PRO features
- ✅ Plugin updates for 1 year
- ✅ Email support
One time — forever
- ✅ All PRO features
- ✅ Lifetime updates
- ✅ Email support
How to Activate PRO
Choose a Plan
Select a suitable plan and pay via secure payment system. It takes less than a minute.
Download PRO Version
Download the PRO version using the link from your license key email and install it over the free version.
Activate the Key
In WordPress admin, go to CyberPulse Security and paste your license key in the activation field.
PRO Activated!
All PRO features unlock instantly. No additional configuration needed.
Frequently Asked Questions
❓ How to install the plugin?
Install the free CyberPulse Security version from WordPress.org repository (Plugins → Add New → search "CyberPulse Security"). Then purchase a PRO license on this site, activate the key in plugin settings — PRO features unlock instantly. No additional installations required.
📧 License email not received?
First, check your Spam folder! Emails often end up there, especially on first purchase. If not found in any folder — contact us with the email used for purchase. We will find your key in the database and resend it.
🔄 What happens after license expires?
PRO features will be disabled, but basic protection continues to work. Your site will not be left unprotected. All your settings, IP whitelist and logs are preserved. You can renew your license at any time — all PRO features will reactivate without data loss.
🌐 Can I use it on multiple sites?
One license works on one site (domain). For each additional site, a separate license is required. This allows us to keep the plugin up to date and develop new features.
☁️ Is Cloudflare required for Turnstile?
No. Cloudflare Turnstile works completely independently. No domain transfer or DNS changes needed. Just register for free on cloudflare.com, get Site Key and Secret Key, and paste them in plugin settings. Free up to 1,000,000 checks/month.
🔒 Does the plugin slow down the site?
No. The plugin works at HTTP header and IP level — before WordPress loads. Checks happen in milliseconds. Results are cached, eliminating repeat checks for the same IP. On a site with 100,000+ monthly visitors, the plugin load is unnoticeable.
🗑 How to uninstall the plugin?
When deleted through WordPress admin, the plugin automatically cleans all its data: logs, settings, block lists. No traces remain.
💳 What payment methods are accepted?
We accept Visa, MasterCard, and instant bank transfers. All payments are processed through a secure payment system. Payment data is not stored on our servers.
🛡️ Does the plugin conflict with others?
The plugin is designed to not conflict with other security plugins. It works at the HTTP header level, before WordPress loads. However, using multiple plugins with Rate Limiting or firewall features simultaneously is not recommended — this may cause double blocking.
🔄 How to transfer a license to another domain?
Contact us with the old and new domain names. We will deactivate the license on the old domain and you can activate it on the new one. Transfer is available for all plans.
Proven Code
- 50 000+ lines of code
- 20+ detection methods
- 10 interface languages
- PHP 7.4-8.4 compatibility
Your Security is Our Priority
- ✅ 14-day money-back guarantee
- ✅ Free version — forever
- ✅ Support response within 24 hours
- ✅ Regular updates and improvements
Ready to protect your site?
Join WordPress users who have already protected their sites with CyberPulse Security PRO.