BadBot Protection tells bots apart from people and from the good bots you want, and stops them before they cost your server time. Everything runs on your own site: no account, no connection to an outside service, no visitor data leaves your website.

What is new in version 5

• Rebuilt for Joomla 4, 5 and 6. Works fully on its own: nothing to register, nothing to buy, no functions locked.
• Browser check on your own server, with Smart, All visitors and Log only modes.
• Search engines are verified by their official address lists or by reverse DNS.
• Protection for the login, registration, password reset, username reminder, contact and administrator login forms.
• Sites with version 1.2 on Joomla 4.2 or newer get 5.0 in the Joomla update manager.

Main features

• Browser check on your own server. Visitors that do not look like a normal browser get a short check page. The browser solves a small calculation in about a second and gets a pass; bots stay outside. Smart mode checks only suspicious visitors, All visitors mode checks everyone once a day during an attack, Log only shows what would be blocked.
• Verified search engines. Google, Bing, Apple, DuckDuckGo, Yandex, Baidu and others are checked against their official address lists or by reverse DNS. Real crawlers pass; scrapers that only pretend to be Googlebot are blocked.
• Bot categories. Allow, check or block search engines, link previews, uptime monitors, AI assistants, AI training crawlers, SEO tools, vulnerability scanners, HTTP libraries and unknown bots. Block AI training crawlers with one click.
• Traps for scanners. Requests for files no visitor ever opens (.env, .git, copies of configuration.php, database tools) and a hidden trap link ban the client for the time you choose.
• Form protection. The login form and login module, registration, password reset and username reminder, contact forms and the administrator login accept posts only from a real browser. People notice nothing; spam bots and password guessers are refused.
• Allow and block lists. IP addresses (IPv4, IPv6, CIDR), User-Agents, and URLs that never get the check.
• Activity and statistics. Charts for 24 hours, 7 and 30 days, the top bots, addresses, pages and reasons, and a log of recent events.
• Your check page. Your logo and texts, with a live preview.
• Safe by design. Logged-in users are never checked; the Web Services API, com_ajax requests and feeds are not touched; the protection starts before the Joomla page cache; an empty file named sgbb-off.txt in the site root switches everything off.

Full website protection

BadBot Protection stops bad bots. SiteGuarding protects the whole website: Website Firewall (WAF), server-side antivirus, hack repair by our experts, DDoS prevention, brute force and card testing protection, GEO blocking and 24/7 monitoring come with the SiteGuarding Premium and Business plans.

Requirements

Joomla 4.2 or newer, tested on Joomla 4.2, 4.4, 5 and 6. PHP 7.2.5 or newer. One package installs the component and its system plugin. Updates come through the Joomla update system.

Connection to SiteGuarding.com

Only the Joomla update check asks siteguarding.com for the latest version. Bot detection, the browser check and the statistics run on your own server; visitor data is never sent anywhere. The check page shows a small "Protected by SiteGuarding" link; you can switch it off in Browser check.