You protect a site from bots and attacks in its Security tab: turn on Challenge Mode to verify visitors' browsers, add Security Rules to block, challenge or allow traffic, and use the IP Deny tab to block single IP addresses.

Built-In Edge Security

Every domain on HostBarrel sits behind our edge security layer. You control it per domain from your site's Security tab - traffic is filtered before it reaches WordPress, so attacks don't consume your site's resources the way a security plugin would. Security settings appear for your custom domains once their SSL is active.

Challenge Mode

Challenge Mode makes every new visitor's browser solve a quick, invisible verification before reaching your site. Real browsers pass in moments; most bots and attack scripts can't. In the Challenge Mode sub-tab you can:

  • Enable or disable challenges for the domain
  • Set the difficulty - higher is harsher on bots but adds a moment more delay for first-time visitors
  • Set the session duration - how long a verified visitor stays trusted before being re-checked
  • Turn on Auto-Challenge - challenges kick in automatically when a traffic spike looks like an attack, and switch off when it passes. Recommended for everyone.

If your site is actively under attack right now, enabling Challenge Mode is the fastest way to shed the malicious traffic.

Security Rules

The Security Rules sub-tab is a firewall rule builder. Each rule combines one or more conditions (matched together) with an action:

  • Block - reject the request outright
  • Challenge - require browser verification first
  • Allow - let it through, bypassing other rules (use for your own IPs)

Rules can be enabled and disabled individually, so you can stage a rule and only arm it when needed.

Ready-Made Templates

Don't build from scratch - start from a template:

  • Protect wp-login - challenge everyone hitting your login page, stopping brute-force attacks cold
  • Block countries - geo-block regions you never do business with
  • Allow office IPs - make sure your team is never challenged or blocked
  • Block bad bots - turn away known scrapers and abusive crawlers

Copying Rules Between Domains

Built a good rule set? Use Copy to other domains... at the top of the Security tab to apply it to some or all of your other domains in one step instead of rebuilding it.

IP Deny List

For simple cases, the IP Deny tab manages a per-site block/allow list. Click Add IP Address, enter one or more addresses and attach a note so future-you remembers why; new entries go on the block list. To trust an address instead, use Move to Whitelist on its row. The tab shows counts of blocked and whitelisted IPs and lets you edit notes or remove entries at any time.