Blackhole for Bad Bots

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 76% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. The recent download trend is too spiky to read.

1. ★★★★★ athinaok

   5mo ago

   Plug in has many problems with Cloudflare

   Read on wp.org ↗
2. ★★★★★ ron441241

   9mo ago

   n/a This topic was modified 8 months ago by ron441241. This topic was modified 8 months ago by ron441241.

   Read on wp.org ↗
3. ★★★★★ Krzysztof

   1.3y ago

   Hi. It seems to be doing its job. I am happy with it. Thanks 🙂 [Blackhole for Bad Bots]

   Read on wp.org ↗
4. ★★★★★ wordwiseweb

   1.4y ago

   I appreciate the protection Blackhole for Badbots has given me for a couple of years, but suddenly I’m getting emails from Google saying their crawlers have been blocked and, within two days, my ranking has plummeted.I know the issue is the caching, and there are posts online about this for when the plugin’s used alongside Siteground’s Optimizer, but after obeying the instructions (there’s only one type of caching you’re supposed to use, apparently), after a lull of a week or so and getting a Google validation fix confirmation, I’m getting the Google emails again. Nothing’s changed in that time?I’m obeying the instructions, but still Google is being blocked? Why on earth would it block Google? Yes, I could stop using all caching, but then my site gets slower and that will also affect my ranking.I’ve had to deactivate the plugin, and I won’t be using it again. I’m hoping my Google ranking quickly recovers, as I spotted the drop fairly quickly. This will cost me money …

   Read on wp.org ↗
5. ★★★★★ silversky99

   1.5y ago

   More than 6 months after deletion its still generating trash pages on Google Search Console(thousands). Even after cleaning everything. Still generating…

   Read on wp.org ↗
6. ★★★★★ nmrockswp

   1.5y ago

   Together with BBQ Firewall the best plugin for WordPress security!

   Read on wp.org ↗
7. ★★★★★ cole1969

   1.9y ago

   Very Well done!

   Read on wp.org ↗
8. ★★★★★ abctaylor

   1.9y ago

   Didn’t work in testing on latest WP + Nginx 1.14.1 when following the nofollow link. The logs should at least be viewable to the site admin, it’s just mean gatekeeping that. This topic was modified 1 year, 10 months ago by abctaylor.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.8.2 Updates Help tab information Improves accuracy of GeoIP lookups Fixes bug with reset options Updates plugin settings page Adds settings page for pro version Improves readme.txt documentation Tests on WordPress 7.0 Full c 3.8.2
2. — Version 3.8.3 Improves nonce security (Thanks Averon Averenkov ) Updates plugin settings page Tests on WordPress 7.1 3.8.3
3. — Version 3.8.4 Special thanks to Averon Averenkov ) for helping to improve the security and usability of this plugin. Removes chrome and other strings from default whitelist Mitigates cache incompatibility with checks for WP_CACHE Impr 3.8.4

2 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header ↗
   2026-03-25 CVE-2026-4329 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8 Patched in 3.8.1
2. Critical · 9.1 Blackhole for Bad Bots <= 3.3.1 - Arbitrary IP Address Blocking via IP Spoofing ↗
   2022-01-31 CVE-2022-1165 Authorization Bypass Through User-Controlled Key Affects < 3.3.2 Patched in 3.3.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 11 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-04-12 40K+ → 30K+ down after 1 days in tier
2. 2025-04-11 30K+ → 40K+ up after 2 days in tier
3. 2025-04-09 40K+ → 30K+ down after 12 days in tier
4. 2025-03-28 30K+ → 40K+ up after 1 days in tier
5. 2025-03-27 40K+ → 30K+ down after 1 days in tier
6. 2025-03-26 30K+ → 40K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 300K+ installs · 3.8★ · 2 shared tags B
• CloudSecure WP Security 100K+ installs · 4.1★ · 2 shared tags B
• BBQ Firewall – Fast & Powerful Firewall Security 100K+ installs · 4.9★ · 2 shared tags A
• Gravity Forms Zero Spam 100K+ installs · 4.2★ · 2 shared tags A
• Login No Captcha reCAPTCHA 60K+ installs · 4.4★ · 2 shared tags A
• Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning 30K+ installs · 4.8★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Blackhole for Bad Bots into a readme, a review or a deck. It updates itself.

Blackhole for Bad Bots: 30K+ active installs, 4.7★ (148 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/blackhole-bad-bots