← All guides · Reviewed November 2026
How Do You Block AI Bots on WordPress, Cloudflare, or Plain JS?
The short answer: one policy, three artifacts — pick the one that matches where your site runs. The Cloudflare Worker (free) enforces at the edge, the WordPress plugin (Pro) enforces on your server, and the plain-JS snippet (Pro) deters in the browser and honestly says so. All three are generated from the same policy in AgentBlock's builder, from the same dated database of 25 agent entries. Kit artifacts as generated by AgentBlock, reviewed November 2026.
Which implementation fits your site?
| Artifact | File | Deploy target | Tier | Enforcement |
|---|---|---|---|---|
| Cloudflare Worker | agentblock-worker.js | Edge — paste into a Worker, add a route | Free | Real: requests are refused before they reach your origin |
| WordPress plugin | agentblock-policy.php | Server — upload, activate | Pro | Real: refused on your server, with a block log |
| Plain-JS snippet | agentblock-snippet.html | Client — paste before </body> | Pro | Deterrent only: runs in the visitor's browser |
How do you deploy the Cloudflare Worker?
- Build your policy in the builder — per-agent choices, starting from the defaults (20 blocked, 1 allowed).
- Download the Worker template from your kit page — it is the free artifact,
agentblock-worker.js, carrying your blocked and allowed lists, kit ID, and kit hash. - Paste it into a new Cloudflare Worker — the file's own header says exactly this: paste into a new Worker and add a route for your domain.
- Add the route for your domain so the Worker sits in front of the site.
- Verify with the kit verifier, and re-run the stale check when the agent database updates.
How do you deploy the WordPress plugin?
- Build your policy the same way — the plugin is generated from the identical policy, not a second setup.
- Download the plugin (Pro):
agentblock-policy.php, requiring WordPress 5.8+ and PHP 7.4+. - Upload and activate it on your site. The generated plugin carries your path rules, canary, and rate caps, plus a block log with CSV export and a stale-kit cron check.
- Read the block log after a day: it shows which named agents actually knocked.
How do you deploy the plain-JS snippet?
- Build your policy and download the snippet (Pro):
agentblock-snippet.html. - Paste it just before
</body>— the snippet's own install line. - Know its limit before you rely on it: the snippet header states it plainly — any agent that disables JavaScript bypasses it completely. Treat it as a deterrent and notice layer, not enforcement. Enforcement belongs at the edge or the server.
Not sure which agents your policy should name in the first place? Start with which AI crawlers you should allow, then read how blocking works end to end. More from the fleet: Ingenious AI.
Frequently asked questions
How do I block AI bots on Cloudflare?
Build your policy in AgentBlock's builder, download the Cloudflare Worker template (free), paste it into a new Cloudflare Worker, and add a route for your domain. The Worker matches known agent user-agents at the edge, before requests reach your origin.
How do I block AI bots on WordPress?
Build your policy, download the generated WordPress plugin (agentblock-policy.php, Pro), upload it to your site, and activate it. The plugin requires WordPress 5.8+ and PHP 7.4+, and includes a block log with CSV export and a stale-kit cron check.
Does the plain-JS snippet really block AI bots?
It deters and notifies; it does not enforce. The snippet runs in the visitor's browser, and any agent that disables JavaScript bypasses it completely. AgentBlock's own snippet header says so: enforcement belongs at the edge (Cloudflare Worker) or the server (WordPress plugin).
How do I verify my block is working?
Run AgentBlock's pre-deploy simulator before you ship, then the kit verifier after: it checks the deployed artifact against the policy you built — the blocked and allowed lists, the kit ID and hash — so a stale or edited kit is caught.
What do the three implementations cost?
The Cloudflare Worker template is the free artifact. The WordPress plugin and the plain-JS snippet are Pro downloads ($29/mo). Team ($79/mo) adds the AgentGate agent-policy.json export on top of the same policy.