Last updated: August 6, 2026 at 9:27 PM
As a countermeasure against plagiarism sites, this site monitors the site using a home-made access analysis CGI (supervised by Gemini), as shown in the gallery below, and uses the WordPress security plugin ``Kadence Security'' to ban suspicious accesses.
However, this was still not enough, so as an additional countermeasure, we implemented a "REST API access denial" script supervised by Gemini on the site.
This effectively prevents mechanical scraping by blocking the bulk acquisition of article data via the API against a large number of plagiarism sites that cannot be prevented with conventional plug-ins or manual reporting.
The implementation uses PHP code to deny access to non-logged-in users while maintaining a whitelist for necessary communications such as contact forms. It also explains how to verify operation after installation, and serves as a technical countermeasure to reduce server load and prevent copyright infringement.
In recent years, a large number of sites that plagiarize articles from Google search have sprung up in certain categories, and our site has suffered considerable damage as well.
The main articles are focused on home appliances (refrigerators, air conditioners, hair dryers, etc.), smartphones, tablets, computers, karaoke equipment, PC peripherals (printers, etc.), equipment (range hoods, washlets, security cameras, etc.), toys, fashion brands, etc.
When we check the target articles (more than 60) every day, there are about 100 plagiarized articles a day, so even if we report them using the Google Search Console report form (DMCA, etc.), we can't keep up.
As a countermeasure for the website, we use the self-made access analysis CGI introduced at the beginning, ``Ultra-light access analysis CGI program (Perl) supervised by Gemini,'' and ban suspicious access using the WordPress security plugin ``Kadence Security.''
However, as content thieves' BOTs are coming in from all over the world every day, these measures are reaching their limits.
As a countermeasure against unauthorized copying of content, this site has already implemented basic measures such as ``setting the distribution of RSS feeds as excerpts'' and ``installing a copy protection plugin,'' so as an additional measure, we have decided to implement ``Countermeasure 1'' (blocking leaks via ``WP REST API'') proposed by Gemini and shown in the chat below.
I'm already doing what I can. The biggest problem is that Google search's AI is too stupid.
I looked at the access log and security dashboard.
As you said,"I've already done everything perfectly."You can see that at a glance.
Access log (cgi-bin/stat/...) to visualize suspicious host names (foreign domains, etc.) andKadence Security Basic(formerly known as iThemes Security)" and installed the You.com crawler (formerly known as iThemes Security).youbot) and Alibaba's Scanbot with pinpoint accuracy.Banned IPs” has been manually registered.I apologize for making such a general plug-in proposal for an engineer who has put up such a detailed barrier.
On top of that, as you pointed out``The biggest problem is that Google search's AI (algorithm) is too stupid to detect the original home.'', that's all. [1, 2]
Currently, many major media outlets and individual bloggers are furious that Google is giving preferential treatment to plagiarism sites and AI-based content thieves, and this has become a serious problem for the entire industry.
Even with this much defense, if 100 emails a day are still being stolen, it is extremely likely that the other party is heavily disguising the IP and User-Agent (using a distributed proxy or residential proxy network), bypassing normal firewalls, and extracting the raw HTML. [1, 2]Waiting for Google to get smarter is a waste of time, but from the screen logs"Two defensive measures that exploit technical blind spots that can still be used"I saw it, so please share it.
🛡️ Measure 1: Block leaks via WP REST API (blind spot)
The bot is not a normal screen (front end), but an API endpoint that WordPress makes public as standard (
/wp-json/wp/v2/posts)from,All beautifully formatted article data is extracted in an instant.There are many cases.
(Actually, it's also at the top of the second image./wp-json/access is recorded) [1]Kadence Security's "WordPress Tweaks" settings, or
functions.phpAdd the following to"Completely deny REST API access to non-logged in users"Please. [1, 2]php
add_filter('rest_authentication_errors', function($result) { if (!empty($result)) { return $result; } if (!is_user_logged_in()) { return new WP_Error('rest_not_logged_in', 'You are not logged in.', array('status' => 401)); } return $result; });Please use the code with caution.
*If you install this, it will be impossible for bots that are not logged in to mechanically obtain article lists or full text via the API. [1, 2]
🛡️ Countermeasure 2: Forced introduction of JavaScript challenge using Cloudflare
The IP rejection feature of the current Kadence Security (Basic version) is to "expel bad IPs that have already accessed the site after the fact." However, if your opponent is using thousands to tens of thousands of distributed IPs (proxies), you will be playing whack-a-mole and will not be able to keep up. [1]
The fundamental solution is to install a free service in front of the server. Cloudflare The most powerful method is to set the following in WAF (security rules).
- ``Managed Challenge (JavaScript human authentication)'' will be automatically imposed on ``accesses from outside Japan'' or ``accesses with suspicious bot scores.''
This allows Cloudflare to intercept the moment a bot tries to access your site, examine the browser's behavior, and forcibly block the bot. Since it is processed before it reaches your WordPress server (Kadence), it also dramatically reduces server load.
Please stop and abandon manual DMCA reports (100 reports) now. It just drains your spirit.
First of all, number 1 above“REST API non-login blocking”We strongly recommend that you check your settings to see if they are enabled.
[Countermeasures against plagiarism sites] Completely deny REST API access to non-logged-in users
Please note that if you completely block the REST API when you are not logged in, the following functions will no longer work, so please be careful.
- Jetpack: Access analysis and automatic linkage will no longer be possible.
- Contact form (e.g. Contact Form 7): When using REST API for asynchronous (Ajax-like) sending processing, sending from general users will result in an error.
- Blog card (oEmbed): The function that allows you to post blog cards for your own articles on external sites will no longer work.
- Smartphone app (WordPress official app): You will no longer be able to log in and write from the app. [1, 2]
*Please note that the management screen (Gutenberg editor, etc.) is operated while you are logged in, so the code above will not be affected at all and will work properly.
Therefore, taking these things into consideration,Contact Form 7 and Jetpack Furthermore, we have reprinted the code and explanation of a modified version of "Countermeasure 1" (only for production sites, complete bypass version) supervised by Gemini, which makes only the acquisition of BOT article data a 401 error (rejection) while fully utilizing WordPress Popular Posts and Gemini AI (functions such as "generate summary") that use Ajax in widgets.
functions.php Please add it to the end of.
/**
* 【パクリサイト対策：本番サイト専用・完全バイパス版】
* 未ログインの外部botのみを遮断し、サーバー内部・プラグインの通信は100%許可する
*
* SERVER_ADDR による例外処理を入れているため、ブロックエディタの動作不良や、
* 各種AI・外部連携プラグインの内部通信を邪魔することなく、悪質な外部botだけを
* ピンポイントで遮断できます。
*/
add_filter('rest_authentication_errors', function($result) {
// 1. すでに他のプラグイン等で認証（Jetpackの署名通信など）が通っている場合はスルー
if ( true === $result || is_wp_error( $result ) ) {
return $result;
}
// 2. 管理者がログインしている場合、または管理画面・Ajaxからの通信はすべて許可
if ( is_user_logged_in() || is_admin() || (defined('DOING_AJAX') && DOING_AJAX) ) {
return $result;
}
// 3. 【本番専用：追加】サーバー自身からのループバック通信（Gemini等の内部処理）を100%許可
if ( isset($_SERVER['REMOTE_ADDR']) && isset($_SERVER['SERVER_ADDR']) ) {
if ( $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] || $_SERVER['REMOTE_ADDR'] === '127.0.0.1' ) {
return $result;
}
}
// 4. 【未ログイン（匿名）】の外部からのアクセスに対する処理
if ( isset($_SERVER['REQUEST_URI']) ) {
$url = $_SERVER['REQUEST_URI'];
// Contact Form 7 や WordPress Popular Posts のフロントエンド通信は許可
if (
strpos($url, '/wp-json/contact-form-7/') !== false ||
strpos($url, '/wp-json/wordpress-popular-posts/') !== false
) {
return $result;
}
}
// 5. 上記以外（外部のbotによる匿名での記事一覧・全文データ引っこ抜き）をすべて遮断
return new WP_Error('rest_not_logged_in', 'REST API restricted.', array('status' => 401));
});
With this code, when a BOT accesses anonymously,HTTP status code 401 (Unauthorized)returns immediately and shuts out without reading a single character.
The reason why this code does not affect the internal system is as follows.
- Jetpack: When Jetpack retrieves and synchronizes data from an external source, the request is authenticated. Therefore, at the very beginning of the code (
true === $resultjudgment)Automatically passes as “authenticated”I will. There is no need to whitelist any IP addresses. - Contact Form 7: Due to the description in number 3, anonymous API communication (
/wp-json/contact-form-7/v1/...) and WPP (WP Popular Posts) with pinpoint exceptions. - Management screen (Gutenberg): Since you are writing while logged in, you will pass the second judgment unconditionally. [1]
After installation, log out ブラウザのURL/wp-json/wp/v2/posts Please access and check if a 401 error (REST API restricted.) screen appears.
Before applying this setting to the production environment, first set it up in a test environment or during a period of low access. functions.php write to,“Can the inquiry form be sent correctly?” “Are there any errors on the Jetpack dashboard?”The best way to be sure is to check.
With this code, the absurd behavior of the bot downloading 100 articles at lightning speed from the back door (JSON data) can be almost completely shut out. Please try it.
Three major verification points at the test site
- Normal inquiry sending test
- procedure: Open the contact page in a browser where you are not logged in (such as an incognito window) and send a test message.
- Qualification benchmark: If there is no error and the message "Sending completed" is displayed as usual, the message is cleared.
- Article data “bukkonuki refusal” test (most important)
- procedure: Directly to the address bar of your browser while logged out.
https://テストサイトのURL/wp-json/wp/v2/postsAccess it by typing. - Qualification benchmark: The JSON data of the article is not displayed and the screen is
{"code":"rest_not_logged_in","message":"REST API restricted."...}ThatIf you get a 401 error (rejection screen), it's a great success.is. This is proof that the intrusion route for rip-off bots has been blocked.
- procedure: Directly to the address bar of your browser while logged out.
- Jetpack synchronization confirmation (possible even after production transition)
- procedure: When the changes are reflected in production, check to see if there are any "linkage error" warnings on the "Jetpack" settings page on the WordPress management screen, and if the access statistics are updated normally.
Advice on implementing it into a production site
If you can pass the test site, there is almost no barrier to implementing it into production, but please keep the following in mind when migrating.
- Final confirmation immediately after production transition:
of the production sitefunctions.phpImmediately after reflecting the code in"Try sending a test message from the Contact Form 7 in an incognito window (not logged in)"Please do just that. If this goes through normally, a perfect defense network will be completed.
This should save you a lot of time from having to deal with 100 absurd DMCA reports every day and being frustrated by Google's slow response.
In the future, if these persistent bots remain that ``directly parse the HTML on the screen (browser) and forcibly copy it'', the next step is as described above. "JS Challenge (Human Authentication)" using Cloudflare's free WAF Let's consider.
