Bot Lockout Security & Risk Analysis

wordpress.org/plugins/bot-lockout

A lightweight WordPress plugin that protects your site from AI scrapers and bad bots using cryptographic JavaScript challenges.

0 active installs v1.0.0 PHP + WP + Updated Jul 29, 2025
anti-scrapingbot-protectioncaptchajavascript-challengesecurity
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Bot Lockout Safe to Use in 2026?

Generally Safe

Score 100/100

Bot Lockout has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 8mo ago
Risk Assessment

The 'bot-lockout' plugin v1.0.0 demonstrates a strong security posture with several positive indicators. Notably, all identified SQL queries utilize prepared statements, significantly mitigating SQL injection risks. Furthermore, the plugin shows a commendable level of output escaping, with 92% of outputs being properly sanitized, which reduces the likelihood of cross-site scripting (XSS) vulnerabilities. The complete absence of dangerous functions, file operations, and external HTTP requests further contributes to its secure design. The presence of nonce and capability checks on its entry points is also a good practice, securing its two identified AJAX handlers.

Vulnerabilities
None known

Bot Lockout Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 17, 2026

Bot Lockout Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
12 prepared
Unescaped Output
4
47 escaped
Nonce Checks
3
Capability Checks
6
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

100% prepared12 total queries

Output Escaping

92% escaped51 total outputs
Data Flows
All sanitized

Data Flow Analysis

2 flows
bot_lockout_ajax_save_settings (bot-lockout.php:1013)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Bot Lockout Attack Surface

Entry Points2
Unprotected0

AJAX Handlers 2

authwp_ajax_bot_lockout_save_settingsbot-lockout.php:96
authwp_ajax_bot_lockout_test_challengebot-lockout.php:97
WordPress Hooks 6
actioninitbot-lockout.php:85
actionwp_enqueue_scriptsbot-lockout.php:92
actiontemplate_redirectbot-lockout.php:93
actionadmin_menubot-lockout.php:94
actionadmin_initbot-lockout.php:95
actionadmin_enqueue_scriptsbot-lockout.php:98
Maintenance & Trust

Bot Lockout Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedJul 29, 2025
PHP min version
Downloads269

Community Trust

Rating0/100
Number of ratings0
Active installs0
Developer Profile

Bot Lockout Developer Profile

kognetiks

3 plugins · 910 total installs

96
trust score
Avg Security Score
94/100
Avg Patch Time
2 days
View full developer profile
Detection Fingerprints

How We Detect Bot Lockout

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/bot-lockout/css/bot-lockout-admin.css/wp-content/plugins/bot-lockout/js/bot-lockout-admin.js/wp-content/plugins/bot-lockout/js/bot-lockout-challenge.js
Script Paths
/wp-content/plugins/bot-lockout/js/bot-lockout-challenge.js
Version Parameters
bot-lockout/js/bot-lockout-challenge.js?ver=bot-lockout/css/bot-lockout-admin.css?ver=bot-lockout/js/bot-lockout-admin.js?ver=

HTML / DOM Fingerprints

CSS Classes
bot_lockout_challenge_container
Data Attributes
data-bot-lockout-ajax-urldata-bot-lockout-noncedata-bot-lockout-timeoutdata-bot-lockout-custom-css
JS Globals
botLockoutVars
REST Endpoints
/wp-json/bot-lockout/v1/challenge
FAQ

Frequently Asked Questions about Bot Lockout