diff --git a/cdn-files/plugin-info.json b/cdn-files/plugin-info.json
index 3a5d6b1..47783b0 100644
--- a/cdn-files/plugin-info.json
+++ b/cdn-files/plugin-info.json
@@ -1,17 +1,17 @@
{
"name": "WebDecoy Bot Detection",
"slug": "webdecoy",
- "version": "2.11.3",
+ "version": "2.11.4",
"author": "WebDecoy",
"author_profile": "https://webdecoy.com",
"requires": "6.1",
"tested": "7.1",
"requires_php": "7.4",
- "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.11.3.zip",
+ "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.11.4.zip",
"sections": {
"description": "WebDecoy provides enterprise-grade bot detection and fraud protection for WordPress websites. Unlike simple CAPTCHA solutions, WebDecoy uses a layered defense approach that analyzes visitors from multiple angles — including deterministic tripwires that catch scanners with zero false positives.
Key Features
- Deterministic tripwires (hidden honeypot paths) — zero-false-positive bot blocking
- Server-side and client-side bot detection
- Invisible proof-of-work challenge (no external CAPTCHA service)
- Comment, login, and registration spam protection
- WooCommerce carding attack prevention
- 60+ good bots automatically allowed
- AI crawler detection and blocking
- Optional WebDecoy Cloud: centralized dashboard, rotation-proof device lockouts, and WAF integrations (from your WebDecoy dashboard, push confirmed attackers to Cloudflare or AWS WAF — blocked before they reach WordPress)
",
"installation": "- Upload the plugin files to
/wp-content/plugins/webdecoy - Activate the plugin through the Plugins menu
- Tripwires and local protection are active out of the box — no API key required
- Optionally go to WebDecoy > Settings > WebDecoy Cloud to connect for centralized monitoring and enforcement
",
- "changelog": "2.11.3
- Added: 14 more crawlers and bots are recognised (235 in total), including RiverBot, IsonSearchBot, Barkrowler, Stripebot, Brightbot, Cloudflare's crawl service, and security scanners from Palo Alto Networks, Recorded Future and VirusTotal.
2.11.2
- Added: 29 more crawlers and AI agents are recognised (221 in total), including Bravebot, Coc Coc, YisouSpider, KimiBot, Kimi-SearchBot, GrokBot, ElevenlabsCrawler, OAI-AdsBot, AdsBot-Google and Meta's ads crawler. Qwant and Ibou are now recognised by their current names (Qwantbot, ibou-search).
2.11.1
- Added: six more crawlers and AI agents are recognised (192 in total): PetalBot (Huawei's Petal Search), Meta-WebIndexer and ShapBot as search crawlers, ExaUser and Shap-User as AI assistants, and Manus-User as an AI agent. Exa's crawler now matches on its product token, so ExaUser is no longer counted as Exa's search crawler.
2.11.0
- New: the dashboard widget and Statistics page show the bots and AI crawlers seen on your site in the last 24 hours, split into verified, claimed and failed verification, with no account needed. Only counts are kept, never visitor addresses or user agents.
- New: the Detections page explains each decoy hit in one plain sentence.
- Changed: the plugin description now leads with card testing and fake WooCommerce orders, and no longer claims indefinite retention or that "Block AI crawlers" blocks AI search crawlers such as PerplexityBot.
- Fixed: the AI referrals table is now created on sites that upgraded past 2.10.0 instead of only on fresh activation.
2.10.6
- Fixed: classic WooCommerce checkout protection and attempt tracking now register after all plugins load. Previously, loading WebDecoy before WooCommerce silently skipped these hooks.
2.10.5
- Fixed: the warning that WebDecoy is not blocking because the site is behind an unconfigured proxy no longer appears on hosts that already pass the visitor's real address to WordPress, such as WordPress.com. On those sites blocking was being withheld for no reason.
- Fixed: the warning's "Configure trusted proxies" button, and the monitor-mode "Review and turn on blocking" button, led to a "not allowed to access this page" error. They now open the settings page.
2.10.4
- Security: good bots such as Googlebot are now verified against the visitor's real address. A visitor could previously choose the address that was checked by sending a forged forwarding header, and on sites behind Cloudflare, WooCommerce checkout checked Cloudflare's address instead of the visitor's.
- Added: the WebDecoy Cloud tab shows whether Slack and webhook alerts are on for your plan, and where to configure them.
- Changed: corrected descriptions of what WebDecoy Cloud does.
2.10.3
- Fixed: rule violations are no longer sent twice or lost while WebDecoy is briefly unavailable, and AI referral counts refused while WebDecoy was busy are kept and sent later.
2.10.2
- Fixed: pages no longer wait up to 20 seconds when WebDecoy Cloud is slow or unreachable. Detections are sent after the page is delivered, and cloud calls pause for a minute while WebDecoy is unavailable.
2.10.1
- Fixed: 2.10.0 stopped sites loading with a fatal error, "Class WebDecoy_AI_Referrals not found".
2.10.0
- Added: when connected to WebDecoy Cloud, the plugin counts visits that AI products such as ChatGPT, Claude, Perplexity and Gemini send to your site, for your AI Traffic page. Only the product name, the landing path and a count are sent; nothing about the visitor.
2.9.1
- Fixed: AI search crawlers and assistants fetching a page for a person are no longer identified as AI training crawlers (Claude-User, Claude-SearchBot, MistralAI-User; PerplexityBot is now a search crawler, as Perplexity documents it).
- Changed: with Block AI crawlers on, PerplexityBot and Claude-SearchBot are let through like other AI search crawlers. Assistants fetching for a person, such as ChatGPT-User and Claude-User, are still refused.
- Added: Perplexity-User, MistralAI-User, Meta-ExternalFetcher and Claude-SearchBot are recognised (186 crawlers).
2.9.0
- Added: per-path crawler rules set in WebDecoy Cloud now apply in WordPress too, by the same rule the edge sensor uses. Cloud rules can only refuse, never allow.
- Changed: crawlers are identified from the shared WebDecoy registry (182, was 54); with Block AI crawlers on, AI agents and assistants are refused along with training crawlers.
2.3.1
- Fixed: Detections forwarded from your site are now identified by the visitor's own request signature. Previously they were identified by your server's outgoing connection, which is the same for every visitor — so every visitor a site reported was grouped into a single "actor" in the dashboard. Only request header names plus Accept-Language and Accept-Encoding are sent; no header values leave your site.
2.3.0
- One-click WebDecoy Cloud connect with automatic key provisioning
- Monthly security report opt-in
- Plan entitlements sync (fails open to free)
- Fixed: Statistics charts growing unbounded with detection data
2.1.0
- JS execution verification to catch non-JS HTTP scrapers
- Challenge token meta tag on page serve; automatic page-serve reporting
2.0.0
- All detection and protection now works locally — no API key required
- Invisible proof-of-work challenge system (SHA-256, no external service)
- Behavioral scoring, statistics page, enhanced detections page
1.3.0
- Bulk IP blocking/unblocking; enhanced good bot detection (60+ bots)
",
+ "changelog": "2.11.4
- Added: after a week on your site, WebDecoy asks once for a review on WordPress.org, naming how many bot visits it counted. Only administrators see it, only on the dashboard and WebDecoy pages, and only when bots were counted. Choose Leave a review, Maybe later or Don't ask again.
2.11.3
- Added: 14 more crawlers and bots are recognised (235 in total), including RiverBot, IsonSearchBot, Barkrowler, Stripebot, Brightbot, Cloudflare's crawl service, and security scanners from Palo Alto Networks, Recorded Future and VirusTotal.
2.11.2
- Added: 29 more crawlers and AI agents are recognised (221 in total), including Bravebot, Coc Coc, YisouSpider, KimiBot, Kimi-SearchBot, GrokBot, ElevenlabsCrawler, OAI-AdsBot, AdsBot-Google and Meta's ads crawler. Qwant and Ibou are now recognised by their current names (Qwantbot, ibou-search).
2.11.1
- Added: six more crawlers and AI agents are recognised (192 in total): PetalBot (Huawei's Petal Search), Meta-WebIndexer and ShapBot as search crawlers, ExaUser and Shap-User as AI assistants, and Manus-User as an AI agent. Exa's crawler now matches on its product token, so ExaUser is no longer counted as Exa's search crawler.
2.11.0
- New: the dashboard widget and Statistics page show the bots and AI crawlers seen on your site in the last 24 hours, split into verified, claimed and failed verification, with no account needed. Only counts are kept, never visitor addresses or user agents.
- New: the Detections page explains each decoy hit in one plain sentence.
- Changed: the plugin description now leads with card testing and fake WooCommerce orders, and no longer claims indefinite retention or that "Block AI crawlers" blocks AI search crawlers such as PerplexityBot.
- Fixed: the AI referrals table is now created on sites that upgraded past 2.10.0 instead of only on fresh activation.
2.10.6
- Fixed: classic WooCommerce checkout protection and attempt tracking now register after all plugins load. Previously, loading WebDecoy before WooCommerce silently skipped these hooks.
2.10.5
- Fixed: the warning that WebDecoy is not blocking because the site is behind an unconfigured proxy no longer appears on hosts that already pass the visitor's real address to WordPress, such as WordPress.com. On those sites blocking was being withheld for no reason.
- Fixed: the warning's "Configure trusted proxies" button, and the monitor-mode "Review and turn on blocking" button, led to a "not allowed to access this page" error. They now open the settings page.
2.10.4
- Security: good bots such as Googlebot are now verified against the visitor's real address. A visitor could previously choose the address that was checked by sending a forged forwarding header, and on sites behind Cloudflare, WooCommerce checkout checked Cloudflare's address instead of the visitor's.
- Added: the WebDecoy Cloud tab shows whether Slack and webhook alerts are on for your plan, and where to configure them.
- Changed: corrected descriptions of what WebDecoy Cloud does.
2.10.3
- Fixed: rule violations are no longer sent twice or lost while WebDecoy is briefly unavailable, and AI referral counts refused while WebDecoy was busy are kept and sent later.
2.10.2
- Fixed: pages no longer wait up to 20 seconds when WebDecoy Cloud is slow or unreachable. Detections are sent after the page is delivered, and cloud calls pause for a minute while WebDecoy is unavailable.
2.10.1
- Fixed: 2.10.0 stopped sites loading with a fatal error, "Class WebDecoy_AI_Referrals not found".
2.10.0
- Added: when connected to WebDecoy Cloud, the plugin counts visits that AI products such as ChatGPT, Claude, Perplexity and Gemini send to your site, for your AI Traffic page. Only the product name, the landing path and a count are sent; nothing about the visitor.
2.9.1
- Fixed: AI search crawlers and assistants fetching a page for a person are no longer identified as AI training crawlers (Claude-User, Claude-SearchBot, MistralAI-User; PerplexityBot is now a search crawler, as Perplexity documents it).
- Changed: with Block AI crawlers on, PerplexityBot and Claude-SearchBot are let through like other AI search crawlers. Assistants fetching for a person, such as ChatGPT-User and Claude-User, are still refused.
- Added: Perplexity-User, MistralAI-User, Meta-ExternalFetcher and Claude-SearchBot are recognised (186 crawlers).
2.9.0
- Added: per-path crawler rules set in WebDecoy Cloud now apply in WordPress too, by the same rule the edge sensor uses. Cloud rules can only refuse, never allow.
- Changed: crawlers are identified from the shared WebDecoy registry (182, was 54); with Block AI crawlers on, AI agents and assistants are refused along with training crawlers.
2.3.1
- Fixed: Detections forwarded from your site are now identified by the visitor's own request signature. Previously they were identified by your server's outgoing connection, which is the same for every visitor — so every visitor a site reported was grouped into a single "actor" in the dashboard. Only request header names plus Accept-Language and Accept-Encoding are sent; no header values leave your site.
2.3.0
- One-click WebDecoy Cloud connect with automatic key provisioning
- Monthly security report opt-in
- Plan entitlements sync (fails open to free)
- Fixed: Statistics charts growing unbounded with detection data
2.1.0
- JS execution verification to catch non-JS HTTP scrapers
- Challenge token meta tag on page serve; automatic page-serve reporting
2.0.0
- All detection and protection now works locally — no API key required
- Invisible proof-of-work challenge system (SHA-256, no external service)
- Behavioral scoring, statistics page, enhanced detections page
1.3.0
- Bulk IP blocking/unblocking; enhanced good bot detection (60+ bots)
",
"faq": "Does WebDecoy slow down my site?
No. WebDecoy adds negligible latency; tripwire checks are a fast path lookup and clearance minting is idle-deferred.
Will it block search engines?
No. WebDecoy automatically allows 60+ known good bots including all major search engines, and tripwires only fire on hidden paths no legitimate crawler follows.
"
},
"icons": {
diff --git a/changelog.txt b/changelog.txt
index 9fb8346..4056f04 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,5 +1,8 @@
*** WebDecoy Bot Detection Changelog ***
+= 2.11.4 - 2026-11-11 =
+* Added: after a week on your site, WebDecoy asks once for a review on WordPress.org, naming how many bot visits it counted. Only administrators see it, only on the dashboard and WebDecoy pages, and only when bots were counted. Choose Leave a review, Maybe later or Don't ask again.
+
= 2.11.3 - 2026-11-11 =
* Added: 14 more crawlers and bots are recognised (235 in total), including RiverBot, IsonSearchBot, Barkrowler, Stripebot, Brightbot, Cloudflare's crawl service, and security scanners from Palo Alto Networks, Recorded Future and VirusTotal.
diff --git a/readme.txt b/readme.txt
index 3988cb8..96a2d8a 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
Tags: ai crawlers, bot analytics, bot detection, woocommerce, card testing
Requires at least: 6.1
Tested up to: 7.1
-Stable tag: 2.11.3
+Stable tag: 2.11.4
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -314,6 +314,9 @@ The bundled good-bot list (sdk/src/GoodBotList.php) stores a documentation URL f
== Changelog ==
+= 2.11.4 =
+* Added: after a week on your site, WebDecoy asks once for a review on WordPress.org, naming how many bot visits it counted. Only administrators see it, only on the dashboard and WebDecoy pages, and only when bots were counted. Choose Leave a review, Maybe later or Don't ask again.
+
= 2.11.3 =
* Added: 14 more crawlers and bots are recognised (235 in total), including RiverBot, IsonSearchBot, Barkrowler, Stripebot, Brightbot, Cloudflare's crawl service, and security scanners from Palo Alto Networks, Recorded Future and VirusTotal.
diff --git a/webdecoy.php b/webdecoy.php
index 7cfc882..5b5d119 100644
--- a/webdecoy.php
+++ b/webdecoy.php
@@ -3,7 +3,7 @@
* Plugin Name: WebDecoy - AI Traffic Analytics & Bot Protection
* Plugin URI: https://webdecoy.com/wordpress
* Description: Understand AI crawler visits and bot identity evidence in WordPress, with local analytics and protection against spam, login abuse, and WooCommerce card testing.
- * Version: 2.11.3
+ * Version: 2.11.4
* Requires at least: 6.1
* Requires PHP: 7.4
* Author: WebDecoy
@@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool
}
// Plugin constants
-define('WEBDECOY_VERSION', '2.11.3');
+define('WEBDECOY_VERSION', '2.11.4');
define('WEBDECOY_PLUGIN_FILE', __FILE__);
define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));