How I Built a Lightweight WordPress Plugin to Combat AdBlockers & Security Threats (WAF)

As web developers and content creators, we face two major, silent battles every single day:

Revenue loss due to aggressive AdBlockers eating up 30-40% of our ad impressions.
Brute-force and security attacks constantly hammering wp-login.php and bloating our databases with logs.

To solve this on my own heavy-traffic news site, I looked at existing plugins. Unfortunately, most of them are incredibly bloated, load heavy external JS libraries, or slow down server response times.

So, I decided to build a lightweight, optimized, developer-friendly solution: Revenue Shield.

In this post, I want to share the architecture and how you can implement a similar lightweight approach to secure your WordPress sites and recover lost ad revenue.

1. The AdBlock Detection Engine (Lightweight & Silent)

Instead of loading bloated third-party detection scripts, Revenue Shield uses a highly optimized double-check mechanism:

Bait Nodes: It injects a tiny, dynamically named bait HTML element (e.g., matching standard ad selectors like adsbox ad-placement doubleclick).
Script Failure Check: It safely triggers a load check on a standard Google AdSense script.

If either of these are blocked by the browser, the system quietly initiates the user-defined overlay or a bottom sticky bar. To make it performant:

We use native CSS custom properties for styling.
The JavaScript is written in pure vanilla JS (no jQuery dependencies on the frontend).
To prevent advanced users from easily hiding the overlay, we developed a Polymorphic Anti-Tamper Engine (available in the Pro upgrade) that randomizes HTML classes and JS function names on every single page render.

2. Hardening WordPress Security (Lightweight WAF)

Many security plugins execute heavy database queries on every request. For Revenue Shield, I wanted to keep the WAF footprint as close to zero as possible.

A) Bruteforce Protection via Transients

Instead of logging every failed login directly into the database (which can quickly crash a server during a massive brute-force attack), the plugin uses secure WordPress Transients

This keeps the server responsive and avoids database bloat during active attacks.

B) Specialized Custom DB Tables
When threats do need to be logged, we don't dump them into wp_options. We use custom database tables (_revshield_logs and _revshield_stats) created during plugin activation using dbDelta(). This ensures query speeds remain lightning-fast and logs can be truncated or exported directly as a CSV without touching core WordPress tables.

The Freemius Integration To make the transition from the free community version to our enterprise-grade Professional version seamless, we integrated the Freemius SDK.

By using Freemius dynamic initialization and compliance tags (like // fs_premium_only_begin and // fs_premium_only_end), we are able to manage a single codebase:

The official WordPress.org version is 100% open-source and compliant.

Users who need advanced features (such as Geo-blocking, Manual IP Blacklisting, Malicious File Upload Scanning, or DDoS Rate Limiting) can upgrade directly from their WordPress dashboard without having to install a separate plugin.

Try It Out & Share Your Feedback!

The plugin is officially live on the WordPress.org Plugin Directory. Whether you want to recover lost ad revenue, secure your login page, or simply look at how a lightweight WAF is structured in PHP, I would love for you to check it out!

Plugin page: https://wordpress.org/plugins/revenue-shield/
I am actively developing this and would love to hear your feedback, feature requests, or constructive criticism in the comments below! What security practices do you implement to keep your WordPress sites lightweight?