Lubber is live and installable from the official WordPress Plugin Directory.

It’s the plugin that came out of the investigation covered in the last two posts: a Singapore-labeled traffic spike that turned out to be a residential-proxy botnet no IP or country list could ever catch, and the decision to stop returning a 403 to traffic like that so a blocked bot has no signal telling it to adapt. Lubber is that approach, packaged as a normal WordPress plugin instead of a set of one-off mu-plugin files on a single site.

What it actually does

  • Blocks named crawlers outright — list the SEO tools and AI scrapers you don’t want, and they’re blocked by name regardless of referrer.
  • Detects no-referrer traffic, at three strengths — from a narrow “missing trailing slash” pattern up to a broad “any request with no referrer” rule, so you can match how aggressive the rule should be to how your own traffic actually behaves.
  • Never touches real crawlers. Google, Bing, and Apple are checked both by name and against their official published IP ranges, so getting one layer wrong can’t expose the other.
  • Leaves genuine visitors alone — Android traffic, AI-assistant referrals (ChatGPT, Perplexity, Claude, Gemini all commonly strip the referrer on a real click), your own IP, logged-in sessions, and WP-CLI are excluded by default.
  • Answers matches with a 200, not a 403 — a tiny static page, no database query, no theme render, and no tracking script — so a match doesn’t cost your server and doesn’t pollute your Analytics or Ads numbers.
  • Everything is a dashboard toggle. No editing PHP to turn a rule on, off, or up.

By default the plugin makes zero outbound network requests — the crawler IP ranges ship bundled. If you turn on the optional daily auto-update for those ranges, the only traffic that leaves your server is a fetch of Google’s, Bing’s, and Apple’s own public range lists; nothing about your site or its visitors goes with it.

Getting it

Search “Lubber” from Plugins → Add New in your WordPress dashboard, or install it directly from wordpress.org/plugins/lubber. Activate it, then visit Settings → Lubber — the two lowest-risk rules (named-crawler blocking and missing-trailing-slash detection) are on by default; the broader no-referrer rule is off until you’ve confirmed it fits your own traffic pattern.

More on which specific signals turned out to matter — and which looked promising but didn’t hold up — in future posts.