Inside a WordPress Bot Detection Engine
Additive threat scoring, MITRE path matching, and HMAC-signed SHA-256 proof of work.
Sep 13, 202611 min read

Search for a command to run...
Additive threat scoring, MITRE path matching, and HMAC-signed SHA-256 proof of work.

A 99.7% accurate detector can still be wrong 1 verdict in 6. Precision, recall, shadow mode, canaries.

Agent auth is not one protocol, it is a stack. Four layers, four questions.

JS signals are eroding. Network signals are ascendant. What survives, ranked.

Solvers cost a fraction of a cent. Here is the six-layer stack that actually replaced them.

Edge middleware, honeypot routes, and origin fingerprinting — a working three-layer guide.
