chore(release): 2.8.3

cdn-files/plugin-info.json

@@ -1,13 +1,13 @@
 {
     "name": "WebDecoy Bot Detection",
     "slug": "webdecoy",
-    "version": "2.8.2",
+    "version": "2.8.3",
     "author": "<a href=\"https://webdecoy.com\">WebDecoy</a>",
     "author_profile": "https://webdecoy.com",
     "requires": "6.1",
     "tested": "7.1",
     "requires_php": "7.4",
-    "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.8.2.zip",
+    "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.8.3.zip",
     "sections": {
         "description": "<p>WebDecoy provides enterprise-grade bot detection and fraud protection for WordPress websites. Unlike simple CAPTCHA solutions, WebDecoy uses a layered defense approach that analyzes visitors from multiple angles — including deterministic tripwires that catch scanners with zero false positives.</p><h4>Key Features</h4><ul><li>Deterministic tripwires (hidden honeypot paths) — zero-false-positive bot blocking</li><li>Server-side and client-side bot detection</li><li>Invisible proof-of-work challenge (no external CAPTCHA service)</li><li>Comment, login, and registration spam protection</li><li>WooCommerce carding attack prevention</li><li>60+ good bots automatically allowed</li><li>AI crawler detection and blocking</li><li>Optional WebDecoy Cloud: centralized dashboard, rotation-proof device lockouts, and WAF integrations (push confirmed attackers to Cloudflare or AWS WAF — blocked before they reach WordPress)</li></ul>",
         "installation": "<ol><li>Upload the plugin files to <code>/wp-content/plugins/webdecoy</code></li><li>Activate the plugin through the Plugins menu</li><li>Tripwires and local protection are active out of the box — no API key required</li><li>Optionally go to WebDecoy &gt; Settings &gt; WebDecoy Cloud to connect for centralized monitoring and enforcement</li></ol>",

changelog.txt

@@ -1,5 +1,9 @@
 *** WebDecoy Bot Detection Changelog ***
 
+= 2.8.3 - 2026-09-21 =
+* Fixed: Block AI crawlers is now an explicit decision rather than a scoring hint. The setting worked by withdrawing a recognised AI crawler's good-bot pass and leaving the rest to heuristic scoring. Scoring adds no points for a recognised bot, so a well-behaved AI crawler sending ordinary headers could stay under the block threshold. With the setting on, a recognised AI crawler is now refused whatever it scores, and the Detections page records the reason as ai_crawler_blocked. The custom allowlist still wins, search engines and social bots are unaffected, and in monitor mode the block is counted rather than applied, like every other action. If you rely on this setting, please update.
+* Internal: added behaviour tests for the AI crawler setting.
+
 = 2.8.2 - 2026-09-18 =
 * Internal: the release build now produces the same tree on every machine, so a zip built here and a zip built in CI carry the same files.
 * Internal: ownership metadata now names WebDecoy LLC as the copyright holder in composer.json and the translation template. Nothing customer facing changed: the plugin is still by WebDecoy.

readme.txt

@@ -4,7 +4,7 @@ Donate link: https://webdecoy.com
 Tags: bot detection, security, spam protection, woocommerce, ai bots
 Requires at least: 6.1
 Tested up to: 7.1
-Stable tag: 2.8.2
+Stable tag: 2.8.3
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -284,6 +284,9 @@ The bundled good-bot list (sdk/src/GoodBotList.php) stores a documentation URL f
 
 == Changelog ==
 
+= 2.8.3 =
+* Fixed: Block AI crawlers now refuses a recognised AI crawler outright instead of leaving the outcome to heuristic scoring. Before this, a well-behaved AI crawler sending ordinary headers could stay under the block threshold. If you use this setting, please update. The custom allowlist still wins, and monitor mode still only counts what it would have blocked.
+
 = 2.8.2 =
 * Internal: release builds are now identical from any machine, and the copyright holder is named as WebDecoy LLC. No functional changes.
 

webdecoy.php

@@ -3,7 +3,7 @@
  * Plugin Name: WebDecoy Bot Detection
  * Plugin URI: https://webdecoy.com/wordpress
  * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection.
- * Version: 2.8.2
+ * Version: 2.8.3
  * Requires at least: 6.1
  * Requires PHP: 7.4
  * Author: WebDecoy
@@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool
 }
 
 // Plugin constants
-define('WEBDECOY_VERSION', '2.8.2');
+define('WEBDECOY_VERSION', '2.8.3');
 define('WEBDECOY_PLUGIN_FILE', __FILE__);
 define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));