WordPress guide · Self-hosted CMS

Marech for WordPress

Monitor AI-scraper traffic in a minute with the snippet — then flip on real server-side blocking with the BlockMe plugin.

PlatformSelf-hosted CMSSetup~2 minutesBlockingSupported

How Marech protects a WordPress site

Self-hosted WordPress is the one place a hosted-CMS site gets real blocking with no proxy in front of it. Start with the monitoring snippet to see who's scraping you, then install the BlockMe plugin to stop non-JS scrapers server-side, before your theme even renders.

Mode 1

Monitoring — the snippet

One line of JavaScript in your <head>. It reports scraper traffic to your dashboard and overlays JS-running bots. Works on WordPress in ~2 minutes.

Mode 2

Blocking — the edge check

A server-side check (the BlockMe WordPress plugin) returns a 403 to scrapers before your content is served — the only thing that stops non-JS scrapers.

Before you begin

You'll need a couple of things ready. The monitoring step needs only the first two.

A Marech account — start a free trial (no credit card).
Access to edit your WordPress site's theme, settings, or code.

Install the monitoring snippet

One line of JavaScript that reports scraper traffic to your dashboard. Works on every WordPress plan and takes about ~2 minutes.

WordPress → Appearance → Theme File Editor → header.php

Copy your Marech snippet

Go to Appearance → Theme File Editor

In your WordPress dashboard, navigate to Appearance, then click Theme File Editor (or Theme Editor).

Select header.php

In the right sidebar, find and click on header.php to edit your theme's header file.

Paste the snippet before </head>

Find the </head> closing tag and paste your Marech snippet immediately before it.

Click Update File

Save the file. Monitoring is now active — scraper traffic will start showing up in your dashboard.

Prefer not to edit theme files?

Install the free 'Insert Headers and Footers' (WPCode) plugin and paste your snippet in the Header section instead — no code editing required.

Verify monitoring is live

Load any page of your site while logged out and check the dashboard traffic feed. Tip: a theme update can overwrite header.php, so if monitoring stops after an update, re-paste the snippet — or use the headers plugin, which survives updates.

Monitoring vs. blocking — the honest version

The snippet above reports traffic and overlays JS-running bots — but non-JS scrapers (curl, python-requests, GPTBot…) download your HTML directly and never run it, so it can't block those. Self-hosted WordPress is the one place where a hosted-CMS site gets real blocking without any proxy in front — the BlockMe plugin checks each request server-side, before your page renders, and returns a 403 to scrapers. Full details in the integration guide.

Turn on real blocking (optional)

Stops non-JS scrapers before your content is served, using the BlockMe WordPress plugin. Needs a Marech API key and a block policy.

Create an API key and a block policy

In the Marech dashboard, open API Keys and create a key (it's shown once — copy it), then open Policies and add a block policy (e.g. bot types scraper and ai_tool).

Install the BlockMe plugin

Download the BlockMe plugin from the marech-BD integrations/wordpress folder on GitHub. In WP admin, go to Plugins → Add New → Upload Plugin, upload it, and Activate.

Configure Settings → BlockMe

Open Settings → BlockMe, paste your API URL (https://api.marech.tech) and the API key you created, tick Enable protection, and Save.

Verify it's blocking

Run the check below — a fake GPTBot request should get a 403 while a normal browser still loads the page. Logged-in users, admin, cron, and REST requests are never checked, so your editing never gets blocked.

Verify it's blocking. You should see HTTP/1.1 403 for the bot user-agent, while your browser loads the page normally. The plugin fails open, so a Marech outage never takes your site down.

verify blocking

curl -A "GPTBot/1.0" -I https://yoursite.com/

Troubleshooting & FAQ

Do I need the plugin if I already pasted the snippet?

Only if you want to actually block scrapers. The snippet monitors; the plugin blocks. Many people run the snippet for a week to see the scale of the problem, then activate the plugin.

Will BlockMe conflict with my caching or security plugins?

No. BlockMe runs its check on front-end page views before the theme renders and fails open on any error. Full-page caches may serve cached HTML without a fresh check — exclude bot user-agents from your cache, or let the edge/Cloudflare option handle blocking upstream.

Does the snippet slow down my site?

No. The script is tiny and loads asynchronously, so it never blocks your page from rendering. Server-side blocking adds a single fast check in front of your origin and fails open, so it can't slow down or take down your site.

Will it block real visitors or hurt SEO?

No. Marech targets automated scrapers, not people, and search engines you care about are allowed by default — you decide exactly what gets blocked with policies. See how detection works.

Next steps

How detection works

The signals Marech uses to tell scrapers from real visitors.

All platform guides

Compare setup and blocking support across every platform.

Write a block policy

Decide exactly which bots get stopped and where.

Plans & pricing

Free 7-day trial, then pick the plan that fits your traffic.

Ready to protect your WordPress site?

Free 7-day trial. No credit card required.