--- title: 404 Guard for WordPress canonical: https://wpsecurityninja.com/404-guard/ --- # Your analytics look fine. Your server doesn't. Bots love guessing URLs: backups, old plugin folders, config files. Each wrong guess can still load WordPress. 404 Guard spots the pattern and blocks the IP before it keeps burning CPU on pages that never existed. - [Get Pro](https://wpsecurityninja.com/pricing/) - [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) ## Count the misses. Block the repeat offenders. One wrong URL from a real visitor is fine. Fifty probes to paths that never existed is not. ### Bot hits fake URLs Scanners probe junk paths that never existed on your site: backup files, old plugin folders, random PHP filenames. ### 404 Guard counts per IP Misses are counted inside a time window you control. Crawlers and your whitelist skip the count. ### Repeat offender blocked Cross the threshold and that IP gets a temporary block. Warnings hit the event log before a block lands. ## Nobody clicks these links. Bots do. If you've opened access logs and seen hundreds of hits to /backup.zip or random .php files you never had, that's not traffic. That's a scanner mapping your site. Analytics stay flat. Your host may still email you about CPU. - Junk paths, old plugin URLs, fake admin files - Same IP, lots of 404s, almost no real page views - Error logs fill up while the site feels fine [Why 404s spike your hosting bill](https://wpsecurityninja.com/404-hammering/) ## Count the misses. Block repeat offenders. One person typing a wrong URL? Fine. Same IP hitting ten missing pages in five minutes? That's probing. 404 Guard counts 404s per IP, then blocks temporarily. Out of the box: 10 missing URLs in 5 minutes triggers a 10-minute block. Tune threshold, window, and block time later if a site gets noisy. - Default: 10 misses in 5 minutes, then a 10-minute block - Threshold 5 to 50, window 1 minute to 1 hour - Warnings log before a block lands [404 Guard docs](https://wpsecurityninja.com/docs/firewall/404-guard/) ## Turn it on once. The defaults handle most sites. You shouldn't babysit firewall rules. Known search crawlers pass through. Uptime monitors and your manual whitelist pass through. Blocks expire on their own. If something looks wrong, check the visitor log or lift the ban from IP management. - Crawlers and whitelisted services are skipped - Blocks are temporary, not permanent bans - See who got blocked in Events Logger and Visitor log [Visitor log](https://wpsecurityninja.com/visitor-log/) ## One piece of the firewall, not a separate plugin 404 Guard lives inside Cloud Firewall with bad-IP blocking, country rules, and login protection. The install wizard turns it on with sane defaults. Running many sites? Lift a 404 Guard ban from MainWP without logging into each dashboard. - Same Firewall screen as the rest of Pro - Wizard enables it on new setups - MainWP support for remote unblocks [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) ## FAQ ### Is 404 Guard free? No. It is part of Security Ninja Pro, inside Cloud Firewall. ### Will it block Google? No. Known search crawlers are allowed. This is for IPs hammering fake paths, not for indexing your site. ### Is this the same as fixing broken links? No. Broken links are a content job. 404 Guard stops bots that blast hundreds of wrong URLs looking for holes. ### What if I block someone by mistake? Blocks expire automatically. You can also lift one from IP management, or from MainWP on connected sites. ### Do I need to configure it on day one? Not really. Setup turns it on with conservative defaults. Tweak it later under Firewall → 404 Guard if a site gets noisy. ### Will it slow my site down? It only runs when enabled. Its job is to stop the same IP from loading WordPress again and again on fake URLs. ## Stop repeat requests to fake URLs 404 Guard plus Cloud Firewall, malware scanning, and login protection. One plugin, not five. [Get Pro](https://wpsecurityninja.com/pricing/)