Drupal Module

BadBot Protection for Drupal

Stop scanners, scrapers, spam bots and fake Googlebots with a browser check that runs on your own server. Real visitors and good bots pass as usual. No account needed, and no visitor data leaves your website.

Last Update: 18 Oct 2026

Version: 5.0

Compatibility: Drupal 10.3 and newer, Drupal 11 and Drupal 12 / PHP 8.1 and newer / MySQL or MariaDB

Price: Free

Download BadBot Protection for Drupal

Unpack the archive into the modules folder of your site, then install the module in Extend.

Why bots matter

Most of the traffic of a typical website is not people. Vulnerability scanners look for holes in your modules, scrapers copy your content, spam bots fill your contact, comment and Webform forms, and password guessers try your login form. They slow the site down for real visitors and put it at risk. BadBot Protection tells them apart from people and from the good bots you want, and stops them before they cost you server time.

What it does

Browser check on your own server. Visitors that do not look like a normal browser get a short check page. The browser solves a small calculation in about a second and gets a pass; bots stay outside. Smart mode checks only suspicious visitors, All visitors mode checks everyone once a day during an attack, and Log only mode shows what would be blocked.
Verified search engines. Google, Bing, Apple, DuckDuckGo, Yandex, Baidu and others are checked against their official address lists or by reverse DNS. Real crawlers pass; scrapers that only pretend to be Googlebot are blocked.
Bot categories. Allow, check or block search engines, link previews, uptime monitors, AI assistants, AI training crawlers, SEO tools, vulnerability scanners, HTTP libraries and unknown bots.
Block AI training crawlers with one click. GPTBot, ClaudeBot, Common Crawl, Bytespider and other training crawlers get blocked, while AI search assistants that send visitors stay allowed.
Traps for scanners. Requests for files no visitor ever opens (database tools such as phpMyAdmin and Adminer, known web shells, secret files such as .env) and a hidden trap link ban the client for the time you choose.
Form protection. The login form and the login block, registration, password reset, contact forms, comment forms and Webform forms accept posts only from a real browser. People notice nothing; spam bots and password guessers are refused.
Allow and block lists. IP addresses (IPv4, IPv6, CIDR), User-Agents, and URLs that never get the check.
Activity and statistics. Charts for 24 hours, 7 and 30 days, the top bots, addresses, pages and reasons, and a log of recent events.
Your check page. Your logo and texts, with a live preview.
Safe for your site. Logged-in users are never checked. The protection runs before Drupal's page cache, so cached pages are protected too. JSON:API, REST requests, the cron URL, feeds and sitemaps are not touched. An emergency switch file turns everything off.

Screenshots

Overview: protection status, the last 24 hours and the last 7 days

The browser check your visitors see for about a second

Bot rules: allow, check or block each category; search engines are verified

Browser check: mode, pass lifetime and your own check page with a preview

Traps for scanners, bans and protected Drupal forms

Activity: charts, top bots, addresses and pages

Private by design

Bot detection, the browser check and the statistics all run on your server. The module does not send visitor data anywhere and needs no account or connection to an outside service.

Full website protection

BadBot Protection stops bad bots. SiteGuarding protects the whole website. Block unwanted bots is part of the SiteGuarding Premium and Business plans, together with:

Website Firewall (WAF): SQL injection, XSS and exploit blocking
Server-side antivirus and daily malware scanning
Hack repair by our experts
DDoS prevention
Brute force and card testing protection
GEO blocking
24/7 monitoring, website backups and an SSL certificate

See Premium and Business plans

FAQ

Will it hurt my search ranking?

No. Google, Bing and other search engines are verified by their official addresses and never see the check. If a crawler cannot be verified, it gets a temporary "try later" answer, never a block.

What do real visitors see?

In Smart mode almost all of them see nothing. In All visitors mode each new visitor sees the check page for about a second, once per day by default.

How do I install it?

Download the archive and unpack it into the modules folder of your site (web/modules/custom on sites built with Composer). Then go to Extend, find BadBot Protection for Drupal and click Install. The protection starts in Smart mode at once; the settings are in Configuration > System > BadBot Protection.

How do I update it?

The module shows a notice on its Overview screen when a new version is out. Replace the module folder with the new one and run the database updates (update.php). Your settings and the activity log stay.

Does it work with Cloudflare and a page cache?

Yes. Cloudflare is detected automatically, and other proxies can be added in the settings. Drupal's own page cache is no problem: the check runs before it. A CDN or Varnish that serves cached pages without asking Drupal answers those requests itself, so they are not checked.

Which database does it need?

MySQL or MariaDB, the databases most Drupal sites use.

Does it send data anywhere?

No. Everything runs on your server. Only the BadBot Protection page in your administration area asks siteguarding.com for the number of the latest version.

I locked myself out. What now?

Create an empty file named sgbb-off.txt in the folder where Drupal's index.php is, with FTP or the file manager of your hosting. The protection stops at once. Delete the file to turn it back on.

Changelog

5.0
- First version for Drupal, on the same core as the WordPress, Joomla and OpenCart editions.
- Browser check on your own server, with Smart, All visitors and Log only modes.
- Verified search engines by official addresses and reverse DNS; fake crawlers are blocked.
- Bot categories, including AI assistants and AI training crawlers.
- Traps for scanners, hidden trap link and bans.
- Protection for the login form and login block, registration, password reset, contact, comment and Webform forms, including Drupal AJAX forms.
- Allow and block lists, excluded URLs, activity charts and log, status report entry.
- Settings and log are kept when the module is uninstalled, unless you choose otherwise.
- Drupal 10.3 and newer, Drupal 11 and Drupal 12.