The plugin activates only when a request claims to be a recognised Google crawler. It checks the visitor against the correct Google IP list for that crawler class, then uscation method—the process Google recommends for identifying genuine crawler traffic.
About the plugin
- Blocks fake Googlebot requests with 403 Forbidden by default.
- Ignores ordinary visitors and unrelated bots.
- Separately verifies Googlebot, AdsBot and user-triggered Google fetchers.
- Supports IPv4 and IPv6.
- Automatically refreshes Google’s published IP ranges.
- Supports Cloudflare’s
CF-Connecting-IPsafely by verifying the connecting Cloudflare proxy. - Includes block and monitor-only modes.
- Records the IP, URL, user agent, hostname and verification failure.
- Provides an IP/CIDR allowlist.
- Allows 403 or 404 responses.
- Includes automatic log cleanup.
What is a fake Google Bot (User Agent)
Fake Googlebots are automated crawlers that pretend to be Google’s legitimate search crawler. They usually do this by copying a Googlebot user-agent string, such as Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html).
A user agent is simply a piece of text sent with a web request that identifies the browser, crawler or software making the connection. It is easy to change, so the name alone does not prove the request came from Google.
This type of impersonation is known as spoofing. In most cases, the attacker is spoofing the bot’s identity in the HTTP headers rather than forging the source IP address itself.
The fake crawler may claim to be Googlebot to bypass firewall rules, avoid rate limits, scrape content, probe WordPress files, search for vulnerabilities or hide other suspicious behaviour.
A genuine Googlebot is verified by checking whether the connecting IP address appears in Google’s official crawler ranges or by performing forward-confirmed reverse DNS.
The IP should resolve to an approved Google hostname, and that hostname must resolve back to the same IP address. If those checks fail, the request should be treated as an impersonator rather than a legitimate Google crawler.
Plugin Use Agreement
- By downloading, installing or using this plugin, you accept full responsibility for its configuration, operation and any resulting effects on your website, server, traffic or search-engine visibility.
- Tech Business News provides the plugin on an “as is” basis and makes no guarantee that it will be error-free or suitable for every hosting environment.
- To the extent permitted by law, Tech Business News is not liable for any loss, damage, downtime, blocked traffic, data loss, security issue or other problem arising from the installation or use of the plugin.
You should back up your website and test the plugin in a staging environment before using it on a live site
Download Here.
This plugin was tested by Tech Business News.
