Recommended Free Tools
The safest way to block bad bots on WordPress is to filter them at Cloudflare’s edge, not inside WordPress. Put the site behind Cloudflare, inspect Bot Analytics, create an exception for verified bots, then block definitely automated traffic and challenge likely automated requests. Use narrower WAF custom rules for abused paths such as /wp-login.php, /xmlrpc.php and /api/, and use rate limiting when the problem is request volume. Make one change at a time and watch logs for false positives before tightening the policy.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What Cloudflare can block before WordPress sees a request
Cloudflare sits in front of the origin server. Requests are evaluated at the edge, so a rule can stop a scraper, vulnerability scanner or credential-stuffing script before it consumes WordPress PHP workers, database connections or login resources. Legitimate visitors continue to the site when they pass the configured checks.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Cloudflare’s bot controls classify traffic in several ways:
- Verified bots: recognized crawlers and services such as Googlebot, Bingbot and monitoring services.
- Definitely automated: traffic Cloudflare has high confidence is scripted.
- Likely automated: traffic that resembles automation but may need a challenge rather than an outright block.
- Bot score: on plans with Bot Management, every request receives a score from 1 through 99. A lower score means a higher probability of automation; Cloudflare describes a low score as a request coming from a script, API service or automated agent.
Cloudflare’s documented baseline uses a score of 1 for an outright block and scores 2 through 29 for a Managed Challenge. Treat those numbers as a starting policy, not a universal answer: a site with unusual integrations or a large developer audience may need a less aggressive threshold.
#1 Best Overall
Before changing a rule, identify the traffic you must preserve
Put the WordPress site behind Cloudflare
Edge bot controls apply only to traffic that reaches the site through Cloudflare. Confirm that the WordPress hostname you are protecting is proxied through your Cloudflare zone and that visitors are not routinely bypassing the protected hostname to reach the origin directly.
Use Bot Analytics and logs first
Open Cloudflare’s Bot Analytics and review the requests reaching the site. Look for user agents, paths, countries, request rates and response patterns associated with scraping, scanning or login abuse. Separate those from traffic that WordPress needs for publishing, scheduled work, health checks, APIs, payments, monitoring and search indexing.
Cloudflare recommends starting with a small threshold and increasing it over time. The practical reason is false positives: a broad challenge can affect a real visitor, an integration or an internal service that happens to look automated. Record the baseline, change one control, and compare the next period of logs with the previous one.
List legitimate automation
Make a short inventory before blocking anything broadly:
- Search crawlers that should index public pages.
- Uptime and availability monitors.
- WordPress loopback requests and scheduled jobs.
- Mobile applications, partner integrations and other API clients.
- Administrative tools used by your team.
This inventory determines whether a suspicious path should be blocked, challenged, or rate-limited. It also gives you a checklist for the verification step after each change.
Step 1: Create the verified-bot exception first
Broad bot rules should not run before the exception for recognized good automation. In Cloudflare’s WAF custom-rule editor, create a rule that identifies verified bots with the expression (cf.bot_management.verified_bot) and assigns the Skip action.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Place this exception ahead of broad bot controls. A Skip action can bypass selected later controls, including rate limiting, Super Bot Fight Mode and managed rules. Review exactly which phases and products the Skip rule covers in your account; do not assume it bypasses every security feature.
The exception protects crawlers and monitoring services that Cloudflare verifies. It does not mean every request claiming to be Googlebot is trusted: the value comes from Cloudflare’s verification, not from a user-agent string that a script can copy.
Step 2: Turn on the built-in bot controls that your plan provides
In Cloudflare’s Security settings, enable the controls available to your plan. The labels Cloudflare documents include Block AI bots, Definitely automated, Likely automated, Verified bots, Static resource protection and Optimize for WordPress.
| Control | What it is for | Availability noted by Cloudflare | Operational choice |
|---|---|---|---|
| Block AI bots | Stops traffic identified as AI crawlers under Cloudflare’s control. | All plans | Enable when you do not want identified AI-crawler traffic fetching site content. |
| JavaScript detections | Adds an automated browser signal used in bot decisions. | Available on all plans; automatic on Free | Leave enabled unless testing shows a compatibility problem. |
| Definitely automated | Targets traffic Cloudflare classifies as clearly scripted. | Super Bot Fight Mode on Pro, Business and Enterprise | Block high-confidence automation after checking analytics. |
| Likely automated | Targets requests with automation indicators but more uncertainty. | Super Bot Fight Mode on Pro, Business and Enterprise | Prefer a Managed Challenge while tuning. |
| Verified bots | Recognizes approved crawlers and services. | Super Bot Fight Mode on Pro, Business and Enterprise | Keep verified traffic allowed or skipped before broad rules. |
| Static resource protection | Applies bot protection to static assets when appropriate. | Super Bot Fight Mode on Pro, Business and Enterprise | Use carefully if scripts, images or feeds are fetched by non-browser clients. |
| Optimize for WordPress | Allows WordPress loopback requests through bot protection. | Listed by Cloudflare for Pro, Business and Enterprise | Enable for WordPress sites, then test publishing and scheduled work. |
Built-in settings are easier to maintain because Cloudflare can update its detections. Their trade-off is less control over one path or one integration. If you need a different action for a login endpoint than for public pages, add a custom rule instead of making the global setting more permissive.
Step 3: Use bot scores when Bot Management is available
Cloudflare Bot Management is an Enterprise paid add-on. It supplies a score from 1 to 99, analytics and granular actions through WAF custom rules or Workers. A low score indicates a more automated request; a high score is not a guarantee that the visitor is human.
A conservative starting policy
- In Bot Analytics, identify how many legitimate requests fall into each score band.
- Create a WAF custom rule that blocks score 1.
- Create a second rule that applies a Managed Challenge to scores 2 through 29.
- Leave higher scores alone while you observe challenge solves, support reports and origin load.
- If automated traffic continues, lower or raise the threshold in small increments rather than changing from permissive to “block everything.”
Keep the verified-bot Skip rule ahead of these score rules. Otherwise, a legitimate crawler could be challenged simply because its request pattern resembles automation.
Why a challenge is safer than a block for uncertain traffic
A block ends the request immediately. A Managed Challenge gives a browser an opportunity to prove that it can complete Cloudflare’s check. That distinction matters for visitors behind corporate gateways, privacy tools or unusual browsers, which can look automated without being malicious. Use a block for high-confidence automation and a challenge for the uncertain band.
Step 4: Protect WordPress paths with custom WAF rules
Global bot settings are useful for broad traffic. Custom rules are better when one endpoint is being abused or when an application needs a different action. Cloudflare specifically identifies path-specific protection, custom score thresholds and combined conditions as reasons to use WAF custom rules.
/wp-login.php
The login endpoint is a common target for password guessing. Create a rule matching the request path /wp-login.php, then choose an action based on your traffic:
- Managed Challenge: a suitable first response when administrators log in from changing networks.
- Rate limit: useful when repeated attempts from one client or a group exceed a defined request rate.
- Block: appropriate only when you have confirmed that the matching traffic should never reach the login form, such as a retired public endpoint.
Do not challenge verified bots on a path they legitimately need, and do not block the administrator’s own access without a tested recovery route. If the login page is restricted by a corporate network or VPN, include that requirement in your rule design rather than relying on a global bot threshold.
/xmlrpc.php
WordPress installations that do not use XML-RPC can protect /xmlrpc.php with a block or a strict rate limit. If a plugin, mobile client or publishing workflow depends on it, challenge or rate-limit only the abusive pattern and test the integration after deployment. A path rule should reflect how the site actually uses XML-RPC; the path alone does not prove that every request is unwanted.
/api/ and other application endpoints
APIs often serve legitimate non-browser clients, so a browser challenge can break a mobile app or webhook. Prefer request-volume controls and narrowly scoped conditions. Separate read endpoints from write endpoints where your application allows it, and verify authentication, publishing, background jobs and third-party callbacks after the rule is enabled.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCombining conditions
A custom rule can combine a path with bot classification, score, method or other request properties. For example, challenge likely automation on a login path while allowing normal browser traffic, or rate-limit repeated requests to an API path without challenging every API consumer. Keep conditions explicit and document the intended exception so a later editor does not broaden the rule accidentally.
Step 5: Add rate limiting for request-volume abuse
Rate limiting is different from bot classification. It reacts to how many requests match a configured rate over a period, while bot controls judge how automated a request appears. Use rate limiting when a login endpoint, API or expensive search route is being hit repeatedly, even if the clients are not all classified as bots.
- Choose the exact path or condition that is consuming resources.
- Set a request rate that normal users and integrations can sustain.
- Choose whether excess requests are challenged or blocked.
- Observe logs and legitimate-client behavior before lowering the limit.
Rule order is critical. When a rule blocks or challenges a request, later phases do not evaluate that request. Conversely, a Skip action can bypass selected later controls, including rate limiting, Super Bot Fight Mode and managed rules. Put exceptions first, then high-confidence blocks, then challenges and rate limits in the order that matches your intended policy. After reordering, test each protected path because changing precedence can silently alter the result.
Step 6: Enable Optimize for WordPress and verify loopback behavior
Cloudflare’s Optimize for WordPress setting is designed to allow WordPress loopback requests through bot protection. Loopbacks are used by WordPress and plugins to call the site itself for scheduled tasks, health checks, publishing workflows and other background operations.
After enabling it, run the operations your site depends on:
- Publish and update a post while logged in as an administrator.
- Confirm scheduled posts and recurring tasks execute.
- Check the WordPress health screen for loopback or HTTP errors.
- Exercise REST API routes and any application integrations.
- Verify uptime monitoring and deployment hooks.
If one operation fails, inspect the matching Cloudflare event before weakening every bot rule. A path-specific exception or a narrower rate limit is safer than disabling protection globally.
Choosing the right approach
| Approach | Precision | Preserves verified bots and loopbacks | Plan availability | Maintenance |
|---|---|---|---|---|
| Built-in bot settings | Broad categories such as definitely or likely automated | Verified-bot controls and Optimize for WordPress are available where the plan includes them | Block AI bots and JavaScript detections on all plans; other listed controls are shown for Pro, Business and Enterprise | Lower; detections can update automatically |
| Bot-score WAF rules | High; score bands can receive different actions | Requires a separate verified-bot exception and loopback testing | Enterprise Bot Management paid add-on | Higher; thresholds need review as traffic changes |
| Path-specific WAF rules | High for login, XML-RPC, API and other endpoints | Depends on the conditions and exceptions you create | Cloudflare WAF capability varies by plan | Higher; site owners maintain paths and integrations |
| Rate limiting | High for request-volume abuse | Verified-bot Skip rules can bypass selected rate-limiting controls | Availability and limits depend on the Cloudflare plan | Moderate; rates must match real client behavior |
The practical combination for many WordPress sites is a verified-bot exception, built-in detection for broad automation, custom protection for sensitive paths and rate limiting for endpoints that are expensive or frequently abused.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting false positives and blocked crawlers
Googlebot or another crawler is challenged
Check that the verified-bot exception exists, uses (cf.bot_management.verified_bot), has a Skip action and is evaluated before broad bot rules. Then inspect the event log to confirm whether Cloudflare recognized the request as verified. Do not solve a crawler problem by allowing every user agent string.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Administrators cannot log in
Review whether the login path is caught by a challenge or rate limit, whether your office network shares an address with other users, and whether a higher-priority block is firing first. Temporarily use a narrower challenge policy while preserving the rest of the site’s protection, then retest from the administrator’s normal network.
Publishing or scheduled tasks fail
Check WordPress loopback health, the Optimize for WordPress setting and Cloudflare events for the failing request. A custom rule aimed at /wp-login.php, /xmlrpc.php or /api/ may also match a plugin workflow. Correct the path or add a narrowly defined exception rather than disabling all bot controls.
An API client receives a browser challenge
Identify the client’s path and request pattern. Replace a browser challenge with a rate limit or an authentication-aware condition when the client cannot execute a browser check. Confirm that the revised rule still limits abuse and that write operations, webhooks and retries succeed.
Origin load remains high
Use Bot Analytics and logs to determine whether traffic is bypassing Cloudflare, whether the rule action is only challenging instead of blocking, or whether a different endpoint is consuming resources. Add a targeted rule for the expensive path and keep the broad threshold conservative until you understand the remaining requests.
A maintenance routine that keeps protection effective
- Review Bot Analytics after significant traffic, plugin or integration changes.
- Watch challenge rates and support reports for false positives.
- Recheck verified-bot handling when adding a new crawler, monitor or API service.
- Audit custom rules for obsolete paths such as an endpoint removed from WordPress.
- Retest publishing, loopbacks, scheduled tasks and APIs after changing rule order.
- Increase bot-score or rate-limit thresholds gradually, following Cloudflare’s advice to start small.
Cloudflare’s built-in controls reduce signature-maintenance work, while custom rules give you precision. The most reliable policy uses both: broad, conservative automation detection plus narrowly scoped rules for the paths that actually need stronger treatment.
Frequently asked questions
Will blocking bad bots stop all scraping?
No. Cloudflare can classify and challenge traffic, but sophisticated scrapers may resemble normal browsers or rotate identities. Combine bot controls with path-specific limits, authentication and sensible application permissions.
Should I block every request with a low bot score?
Use Cloudflare’s documented score-1 block and 2–29 challenge as a starting point when Bot Management is available, then adjust from analytics. A score threshold is a policy choice, not proof that every request in a band is malicious.
Do I need Enterprise for basic WordPress bot protection?
No. Cloudflare lists Block AI bots and JavaScript detections on all plans, with additional Super Bot Fight Mode controls shown for Pro, Business and Enterprise. The 1–99 bot score, analytics and granular score actions require the Enterprise Bot Management add-on.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why does rule order change the result?
A block or challenge ends evaluation for that request, so later phases do not run. A Skip action can bypass selected later products. Put verified-bot exceptions before broad controls and verify precedence whenever you edit rules.
What should I do if a legitimate monitor is not recognized as verified?
Do not broadly allow all automation. Identify the monitor’s stable request characteristics and create the narrowest exception or rate-limit policy that supports it, then confirm the result in Cloudflare logs.
Frequently Asked Questions
Can I protect only wp-login.php instead of challenging the whole site?
Yes. Use a WAF custom rule matching the /wp-login.php path and choose a Managed Challenge, rate limit or block according to your administrator access and observed traffic.
Is Optimize for WordPress a replacement for custom rules?
No. It addresses WordPress loopback requests. You still need custom rules or rate limits for abused login, XML-RPC and API endpoints.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
