The reliable way to stop WordPress bots is layered protection: filter suspicious requests at a managed WAF or CDN, slow authentication abuse at the web server, harden WordPress accounts, patch every component, monitor logs, and keep tested backups. No single plugin, firewall rule, or hidden login URL can provide that coverage by itself.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Start by observing normal traffic, then add narrow controls for wp-login.php, XML-RPC, and other expensive unauthenticated paths. Preserve verified crawlers, Jetpack and loopback requests, APIs, cron jobs, administrators, and trusted monitoring while challenging or temporarily banning behavior that looks abusive.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What WordPress bot attacks are trying to do
A bot is simply software making requests automatically. Many bots are harmless, such as search crawlers, uptime monitors, feed readers, and WordPress services. Malicious automation has different goals:
- Credential attacks: repeated guesses against
wp-login.phpor XML-RPC methods. - Vulnerability scanning: requests for old plugin, theme, core, or server files known to contain flaws.
- Resource exhaustion: floods that consume PHP workers, database connections, memory, CPU, or bandwidth.
- Content and abuse actions: spam submissions, unauthorized account creation, scraping, or destructive authenticated requests.
- Pivoting: using a compromised WordPress installation to attack other applications or obtain broader VPS access.
The practical risk is not only a busy website. A successful compromise can expose credentials, modify files, create administrator accounts, or provide a foothold on the server. Treat bot defense as a chain of controls, with recovery capability behind it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The four-layer defense model
Each layer sees different evidence and has a different cost when it rejects a request. Blocking at the edge is usually cheaper than allowing the request to reach PHP, but only WordPress knows whether a logged-in action is legitimate. Use the layers together.
| Layer | Where it acts | What it can detect | Why it matters | Typical controls |
|---|---|---|---|---|
| Edge WAF/CDN | Before the VPS | IP reputation, bot score, signatures, geography, request patterns | Stops much of the traffic before it consumes origin CPU or database capacity | Managed rules, challenges, verified-bot handling, endpoint-specific rules, rate limits |
| Web server | Nginx or Apache on the origin | Request rate, response codes, expensive paths, connection behavior | Protects the application when traffic has already reached the server | Per-site and per-IP throttling, request limits, ModSecurity or OWASP CRS rules |
| WordPress | Application and database | Authentication failures, roles, plugin behavior, XML-RPC use | Applies business context that network controls cannot see | Updates, least privilege, 2FA, passkeys, XML-RPC policy, login alerts |
| Account and recovery | Administrator identity and backups | Privilege changes, unusual sign-ins, restoration readiness | Limits the damage of a successful login or exploit | Unique credentials, temporary bans, tested backups, documented recovery |
Baseline your traffic before blocking anything
Spend several days recording normal behavior before imposing aggressive limits. A baseline prevents you from mistaking a legitimate service for an attacker and gives you evidence when tuning a rule.
Record the requests that must keep working
- Administrator logins from normal office, home, or VPN addresses.
- WordPress cron jobs and scheduled tasks.
- REST or other APIs used by your site or integrations.
- Jetpack requests and WordPress loopback requests.
- Verified search crawlers and uptime or monitoring services.
- Publishing workflows, media uploads, webhooks, and any other known high-volume action.
Record the signals that indicate abuse
Track repeated failures by endpoint, source identity, time window, status code, and user agent. A rotating set of addresses can represent one bot network, so do not rely on a single IP as your only identity. Repeated 403 or 404 responses, bursts against nonexistent files, and failed authentication concentrated on one endpoint are useful indicators when combined with rate and response behavior.
Keep rule-match logs and review them after every change. A challenge is safer than a permanent block while you are still learning what normal traffic looks like.
Put the site behind an edge WAF or CDN
A managed WAF/CDN is the first opportunity to reject suspicious automation before it reaches the VPS. Confirm that DNS points to the service, TLS is valid, and the origin is reachable only as intended. Verify WordPress loopback requests and every external integration after the change.
Enable managed protection and visibility
- Turn on the provider’s managed WAF rules and keep their rule updates enabled.
- Enable bot analytics or bot-score visibility so you can distinguish likely automation from ordinary browsers.
- Challenge suspicious requests first. Use a block only when the signal is strong and the impact is understood.
- Allow verified search crawlers and trusted services where appropriate, using verification rather than a user-agent string alone.
- Review matched-rule logs, challenge rates, origin errors, and false positives daily during the initial tuning period.
Protect the high-value paths
Add targeted rules for wp-login.php, XML-RPC, password-reset routes, and expensive unauthenticated endpoints. A rule that challenges or throttles only these paths is less disruptive than a site-wide challenge. Cloudflare describes bot-score controls, WordPress loopback optimization, and Turnstile/WAF layering as ways to combine these signals without treating every visitor as hostile.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not assume an edge service makes the origin invisible. Restrict direct origin access where your architecture permits it, keep origin software patched, and monitor requests that bypass the edge.
Rate-limit login and XML-RPC deliberately
Rate limiting is most effective when it reflects the endpoint’s job and the identities involved. Cloudflare describes protecting a login endpoint from credential stuffing as a typical rate-limiting use case. WordPress hosting guidance likewise recommends throttling both maximum logins per site over time and maximum attempts per IP across the infrastructure.
Use a staged policy
- Observe: measure normal administrator, API, cron, and service traffic.
- Challenge: require an additional verification step for suspicious rates or bot scores.
- Throttle: delay or reject repeated attempts for a short period.
- Temporarily ban: hand repeated, clearly abusive behavior to Fail2ban or an equivalent tool.
- Review: inspect false positives and adjust by endpoint, identity, and response behavior.
Count more than IP addresses. A botnet can rotate addresses, while several legitimate administrators may share one address. Combine per-site limits with per-IP limits, and consider account, cookie, session, or response-code signals where your edge and server support them. Cookie-based counting can help identify one rotating bot network, but never use it as the only control because cookies are easy for automation to discard.
wp-login.php
Login traffic should tolerate normal human retries without permitting unlimited guesses. Alert on repeated failures, challenge unusual bursts, and temporarily ban sources that continue after a challenge or throttle. Keep a documented allowlist process for trusted monitoring and administrator access so an emergency lockout can be reversed.
XML-RPC
Decide whether XML-RPC is actually required. If it is unused, disable or block it at the narrowest layer that fits your deployment. If Jetpack or another integration depends on it, do not apply a blanket block: baseline its requests, allow the required service, and rate-limit or challenge the remaining traffic. Test publishing, remote management, and any connected application after every change.
Expensive unauthenticated endpoints
Search, password reset, comment, feed, and API routes can consume resources even when they do not authenticate a user. Apply limits based on cost and normal usage, not on a generic site-wide number. Log the rule that acted and the response returned so you can identify an accidental denial of a legitimate integration.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Harden administrator identities inside WordPress
Authentication is a primary target because one valid administrator session can bypass many network controls.
Use unique credentials and least privilege
- Give every administrator a unique, long password that is not reused on another service.
- Remove legacy or shared administrator accounts, including predictable accounts such as
adminwhen they are no longer needed. - Assign the lowest role that lets each person do their work. Editors, authors, support users, and integrations should not receive administrator privileges by default.
- Remove inactive users and review role changes as security events.
Require stronger authentication
Enable two-factor authentication for every administrator. Where supported, prefer WebAuthn passkeys or a FIDO2 security key because the cryptographic credential is resistant to password reuse and phishing. Keep a controlled recovery method and at least one tested break-glass account so an administrator does not lock the entire team out.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Do not rely on hiding the login URL
Changing or obscuring the login address may reduce casual noise, but it is not an authentication control. Attackers can discover alternate routes, use existing sessions, or target XML-RPC and APIs. Keep the real protections—unique credentials, least privilege, multifactor authentication, rate limits, monitoring, and patches—in place.
Keep WordPress and the VPS patched
Old versions expose known vulnerabilities that automated scanners can find quickly. Maintain updates for WordPress core, every active theme and plugin, the operating system, the web server, PHP or other runtime components, and security tooling.
Remove what you do not maintain
Deactivate and remove abandoned plugins, themes, test code, and old administrator accounts. An inactive component still expands the attack surface if its files remain reachable or its vulnerability is known.
Make patching observable
- Subscribe to security advisories for WordPress, your operating system, web server, and major components.
- Record update dates and the person responsible.
- Test important publishing, payment, API, cron, and backup functions after updates.
- Patch the VPS even when WordPress itself is current; a vulnerable SSH service, runtime, or web server can undermine application controls.
Harden the VPS and web server
Reduce exposed services
Expose only the ports and services the site requires. Administer over encrypted SSH or SFTP, protect administrative access with strong credentials and multifactor authentication where available, and avoid leaving development dashboards or database services reachable from the public internet.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Throttle at the origin
Configure Nginx or Apache limits for authentication endpoints and expensive paths that remain reachable after edge filtering. Set separate policies per site and per IP rather than one global ceiling. Ensure limits do not break legitimate administrator work, APIs, cron jobs, uploads, or Jetpack.
Use server-side detection
ModSecurity rulesets such as the OWASP Core Rule Set can detect and block brute-force patterns at the server layer. This is a second line of defense, not a substitute for patching or identity controls. Start in a logging or detection mode where practical, examine matches, then enforce narrow rules with an exception process.
Connect logs to temporary bans
Fail2ban or an equivalent tool can watch authentication and web-server logs, then create temporary firewall bans after repeated failures. Temporary bans are safer than permanent IP or country blocklists: they slow an active source while allowing addresses to return after the behavior stops and reducing the chance of locking out mobile users, shared offices, or legitimate services.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Define which log patterns trigger a ban, how many events are required, how long the ban lasts, and who can remove it. Preserve an allowlist for trusted monitoring, office addresses, and verified services, with a documented review path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Monitor for compromise, not just traffic volume
A quiet bot can be more dangerous than a loud flood. Review authentication and application events for:
- Repeated failed logins followed by a success.
- Successful administrator logins at unusual times, locations, or devices.
- New users, role changes, password resets, or disabled security settings.
- Unexpected plugin, theme, core, or server-file changes.
- Sudden outbound mail, database growth, CPU use, or child processes.
- Rule matches showing repeated 403, 404, login, or XML-RPC activity.
Centralize logs where possible and retain enough history to reconstruct an incident. Alerts should identify the account, endpoint, source, time, response, and rule that acted. A useful alert leads to a decision; an unfiltered stream of every request quickly becomes noise.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Backups and recovery are part of bot defense
Assume that a control can fail. Maintain backups that are independent of the VPS and test restoration on a schedule. A backup is only useful if you know what it contains, how long restoration takes, and who can perform it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDocument the recovery sequence
- Record who can disable or adjust WAF rules and who can regain administrator access.
- Isolate a compromised site or VPS from the network while preserving logs needed for investigation.
- Restore WordPress, the database, uploads, and configuration from a known-good point rather than copying potentially modified files forward.
- Rotate administrator, database, SSH, API, and integration credentials after recovery.
- Patch the operating system, web server, WordPress, themes, and plugins before reconnecting the site.
- Review users, roles, scheduled tasks, webhooks, and outbound activity, then monitor closely after reopening access.
Practice this process before an emergency. Record backup locations, encryption keys, DNS and TLS ownership, and the emergency contact who can approve a rule rollback.
Managed WAF versus Fail2ban: what each solves
| Question | Managed WAF/CDN | Fail2ban or equivalent |
|---|---|---|
| Where it acts | At the edge, before the VPS | On the VPS after logs are generated |
| Primary signals | Bot score, reputation, signatures, request patterns, endpoint rules | Repeated log events such as failed authentication or matching web requests |
| Origin-resource impact | Can reject traffic before PHP workers and database connections are used | Consumes some origin resources before a log event triggers a ban |
| False-positive controls | Challenges, verified-bot handling, allowlists, rule exceptions | Thresholds, ban duration, allowlists, and jail-specific exceptions |
| Operational cost | Provider plan limits, rule maintenance, analytics retention, and DNS/TLS administration | Server configuration, log parsing, firewall integration, and incident review |
| Best use | Broad automated traffic reduction and edge filtering | Temporary response to repeated behavior observed at the origin |
They are complementary. An edge service cannot replace WordPress account security, and Fail2ban cannot prevent a high-volume request from consuming resources before the origin sees it.
A practical implementation runbook
- Baseline for several days: identify normal administrator, API, cron, Jetpack, loopback, monitoring, and verified crawler behavior.
- Deploy the edge layer: verify DNS, TLS, origin reachability, loopback requests, integrations, and direct-origin assumptions.
- Enable managed WAF rules and analytics: challenge suspicious automation and allow verified services deliberately.
- Add narrow limits: protect
wp-login.php, XML-RPC, and expensive unauthenticated endpoints; log every match. - Harden accounts: remove legacy administrators, enforce least privilege, require 2FA, and add WebAuthn or a FIDO2 key where supported.
- Patch everything: update core, themes, plugins, runtime, operating system, and web server; remove abandoned components.
- Harden the VPS: expose only required ports, use encrypted administration, centralize logs, and apply origin throttles.
- Automate temporary response: connect repeated failed-login or abusive request patterns to Fail2ban, while preserving an allowlist process.
- Test recovery: restore backups, verify credentials and ownership, and record the rollback path for WAF and authentication changes.
Troubleshooting common failures
Legitimate administrators are challenged or banned
Check the rule’s identity and time window, not only the displayed IP. Shared office networks, mobile carriers, VPNs, and IPv6 rotation can make several people appear as one changing source. Shorten the temporary ban, add a controlled allowlist, or use a stronger authentication challenge instead of a permanent block. Keep logging enabled while you tune.
Jetpack, cron, or loopback requests fail
Compare the failed request with your baseline. Confirm that the integration is verified and permitted, then narrow the XML-RPC or WAF rule to abusive behavior rather than disabling the service globally. Re-test publishing, scheduled tasks, and health checks after each exception.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
CPU remains high after enabling the WAF
Inspect origin traffic for direct-IP access, expensive endpoints, and requests that pass the edge because they are not covered by a rule. Add server-side rate limits, protect the specific path, and check PHP workers, database connections, and web-server queues. A challenge applied only after application processing will not solve an origin exhaustion problem.
Attackers keep returning from new addresses
Stop expanding a permanent IP blocklist. Use bot-score, request-rate, response-code, cookie or session, and authentication-failure signals together. Apply per-site and per-IP throttles, then use temporary bans for repeated behavior. Review whether a compromised account or leaked credential is producing valid-looking requests.
An administrator is locked out
Use the documented break-glass account or security-key recovery method, then remove the emergency exception after access is restored. If the lockout came from Fail2ban or an edge rule, follow the recorded rollback path rather than editing production controls blindly. Investigate why the normal allowlist or recovery method failed.
What success looks like
Effective protection does not mean every automated request disappears. It means suspicious traffic is challenged or rejected as early as practical, legitimate crawlers and services continue to work, authentication abuse is throttled, vulnerable software is removed, and an incident can be contained and restored without guesswork. Review the controls after major WordPress, hosting, DNS, integration, or traffic changes; bot behavior changes, but the layered design remains the same.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
