From 78096cd45bbc78529058a11017ceebbfade346a3 Mon Sep 17 00:00:00 2001 From: Chris Portscheller Date: Tue, 22 Sep 2026 22:50:33 -0500 Subject: [PATCH] chore(release): 2.9.0 --- cdn-files/plugin-info.json | 6 +++--- changelog.txt | 2 +- readme.txt | 6 +++++- webdecoy.php | 4 ++-- 4 files changed, 11 insertions(+), 7 deletions(-) diff --git a/cdn-files/plugin-info.json b/cdn-files/plugin-info.json index 356e72f..61b1d4d 100644 --- a/cdn-files/plugin-info.json +++ b/cdn-files/plugin-info.json @@ -1,17 +1,17 @@ { "name": "WebDecoy Bot Detection", "slug": "webdecoy", - "version": "2.8.3", + "version": "2.9.0", "author": "WebDecoy", "author_profile": "https://webdecoy.com", "requires": "6.1", "tested": "7.1", "requires_php": "7.4", - "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.8.3.zip", + "download_url": "https://cdn.webdecoy.com/wordpress/webdecoy-2.9.0.zip", "sections": { "description": "

WebDecoy provides enterprise-grade bot detection and fraud protection for WordPress websites. Unlike simple CAPTCHA solutions, WebDecoy uses a layered defense approach that analyzes visitors from multiple angles — including deterministic tripwires that catch scanners with zero false positives.

Key Features

", "installation": "
  1. Upload the plugin files to /wp-content/plugins/webdecoy
  2. Activate the plugin through the Plugins menu
  3. Tripwires and local protection are active out of the box — no API key required
  4. Optionally go to WebDecoy > Settings > WebDecoy Cloud to connect for centralized monitoring and enforcement
", - "changelog": "

2.3.1

2.3.0

2.1.0

2.0.0

1.3.0

", + "changelog": "

2.9.0

2.3.1

2.3.0

2.1.0

2.0.0

1.3.0

", "faq": "

Does WebDecoy slow down my site?

No. WebDecoy adds negligible latency; tripwire checks are a fast path lookup and clearance minting is idle-deferred.

Will it block search engines?

No. WebDecoy automatically allows 60+ known good bots including all major search engines, and tripwires only fire on hidden paths no legitimate crawler follows.

" }, "icons": { diff --git a/changelog.txt b/changelog.txt index a23c8c0..f49277c 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,6 +1,6 @@ *** WebDecoy Bot Detection Changelog *** -= Unreleased = += 2.9.0 - 2026-09-23 = * Added: per-path crawler rules set in WebDecoy Cloud now apply in WordPress too. If your site is connected and you have told WebDecoy to refuse, say, AI training crawlers on /premium/*, this plugin refuses them there as well, using the same rule the WebDecoy edge sensor uses. Watched paths and sites in Monitor count what would have been refused instead of refusing. The rules are read from WebDecoy twice daily and shown under the AI Crawlers setting; a copy older than two days is not applied. Precedence is simple: cloud rules can only refuse, never allow; Block AI crawlers still refuses site-wide; the custom allowlist exempts a bot from Block AI crawlers but not from a cloud path rule; and this plugin's monitor mode still gates every block. * Changed: known crawlers are now identified from the same crawler registry the WebDecoy dashboard and the other WebDecoy sensors use, instead of a list kept only in this plugin. A crawler is named the same thing here and in your reports. The registry knows 182 crawlers where the old list knew 54, so more search engines (Naver, Seznam, Ecosia, Mojeek and others), more AI crawlers (ByteSpider, Mistral, YouBot and others) and more link-preview, monitoring, SEO and feed services are recognised as what they are. * Changed: with Block AI crawlers on, AI agents and assistants that browse on a person's behalf (for example ChatGPT-User, Claude-User, Operator, Siri) are refused along with training crawlers, and so are the newly recognised AI crawlers above. ChatGPT-User and OAI-SearchBot are now classified as OpenAI documents them (an assistant and a search crawler, neither used for training), which matters once per-path crawler policy arrives; under this setting they are refused either way. The setting is the one instruction about AI traffic; if you want a specific one through, add it to the custom allowlist by name. diff --git a/readme.txt b/readme.txt index 439696b..d081972 100644 --- a/readme.txt +++ b/readme.txt @@ -4,7 +4,7 @@ Donate link: https://webdecoy.com Tags: bot detection, security, spam protection, woocommerce, ai bots Requires at least: 6.1 Tested up to: 7.1 -Stable tag: 2.8.3 +Stable tag: 2.9.0 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html @@ -284,6 +284,10 @@ The bundled good-bot list (sdk/src/GoodBotList.php) stores a documentation URL f == Changelog == += 2.9.0 = +* Added: per-path crawler rules set in WebDecoy Cloud now apply in WordPress too. Connect your site, protect a path in the WebDecoy dashboard and refuse, say, AI training crawlers on it, and this plugin refuses them there as well, by the same rule the WebDecoy edge sensor uses. Watched paths and sites in Monitor count what would have been refused. Cloud rules can only refuse, never allow; Block AI crawlers and the custom allowlist keep working as before. +* Changed: known crawlers are identified from the same registry the WebDecoy dashboard uses (182 crawlers, was 54), so a crawler is named the same thing here and in your reports. With Block AI crawlers on, AI agents and assistants that browse for a person (ChatGPT-User, Claude-User and others) are refused along with training crawlers; add a specific one to the custom allowlist to let it through. + = 2.8.3 = * Fixed: Block AI crawlers now refuses a recognised AI crawler outright instead of leaving the outcome to heuristic scoring. Before this, a well-behaved AI crawler sending ordinary headers could stay under the block threshold. If you use this setting, please update. The custom allowlist still wins, and monitor mode still only counts what it would have blocked. diff --git a/webdecoy.php b/webdecoy.php index 0a7332c..2c2cb13 100644 --- a/webdecoy.php +++ b/webdecoy.php @@ -3,7 +3,7 @@ * Plugin Name: WebDecoy Bot Detection * Plugin URI: https://webdecoy.com/wordpress * Description: Protect your WordPress site from bots, spam, and carding attacks with WebDecoy's advanced threat detection. - * Version: 2.8.3 + * Version: 2.9.0 * Requires at least: 6.1 * Requires PHP: 7.4 * Author: WebDecoy @@ -41,7 +41,7 @@ function str_starts_with(string $haystack, string $needle): bool } // Plugin constants -define('WEBDECOY_VERSION', '2.8.3'); +define('WEBDECOY_VERSION', '2.9.0'); define('WEBDECOY_PLUGIN_FILE', __FILE__); define('WEBDECOY_PLUGIN_DIR', plugin_dir_path(__FILE__)); define('WEBDECOY_PLUGIN_URL', plugin_dir_url(__FILE__));