Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe safest way to reduce bot-related load on WordPress is to measure the traffic first, then block or rate-limit abusive requests before they reach PHP. Put a reverse-proxy firewall or CDN in front of the site, protect /wp-login.php and /xmlrpc.php with endpoint-specific limits, preserve verified search crawlers, and use robots.txt only for cooperative crawl guidance. Add a WordPress plugin only when edge and web-server controls are unavailable.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This layered approach lowers origin work without accidentally hiding pages from Google or breaking Jetpack, mobile apps, APIs, caching, or single-sign-on integrations.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat bot traffic is costing your WordPress site
Bot traffic is not one thing. Search crawlers, uptime monitors, feed readers, social link previewers, vulnerability scanners, credential-stuffing tools, scrapers, and badly written automation all appear in access logs as HTTP requests. Some are useful; others repeatedly invoke expensive WordPress code.
A request becomes especially costly when it bypasses the page cache, starts PHP, performs a database query, runs authentication logic, creates a session, or causes a plugin to call an external service. A small number of abusive clients can therefore consume more CPU and PHP workers than a much larger number of cached page views.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Do not begin by blocking every unfamiliar user agent. User-agent strings are easy to forge, and an aggressive rule can block legitimate visitors or search indexing. The first job is to identify which clients, paths, response codes, and request rates are actually creating origin work.
1. Establish a measurable baseline
Record a before-and-after window so you can judge a rule with evidence rather than a promised percentage reduction. There is no universal bot percentage or guaranteed server-load reduction that applies to every WordPress installation; the result depends on caching, hosting, plugins, traffic mix, and the specific abuse pattern.
Review both edge and origin data
- In your CDN or WAF, open the bot-analytics view and review the busiest user agents, countries, IPs, autonomous systems, requested paths, and request rates.
- In the web-server access log, compare the same clients with status codes, bytes sent, cache status, request duration, and whether the request reached PHP.
- In hosting metrics, note PHP worker saturation, CPU, memory, database load, slow requests, and queueing during the same period.
- Separate cached responses from uncached responses. A high request count is less urgent when the edge serves the response without contacting the origin.
Build a useful traffic inventory
| Field | What to record | Why it matters |
|---|---|---|
| User agent | The complete user-agent string and how often it appears | Helps group automation, but should not be the sole identity check because it can be forged. |
| Source | IP address, network or ASN, country, and whether the address changes | Supports narrow blocks or limits without penalizing unrelated visitors. |
| Path | URL, including query-string patterns | Shows whether the load comes from login, XML-RPC, search, feeds, APIs, or ordinary pages. |
| Rate | Requests per minute and bursts over a short interval | Distinguishes a normal crawler from a client making repeated, harmful bursts. |
| Response | Status code, cache hit or miss, duration, and response size | Connects traffic to origin work and reveals repeated errors or uncached requests. |
Classify before creating a rule
Put each significant source into one of four working groups: verified legitimate crawler, known site integration, ordinary human or customer traffic, and abusive or unidentified automation. Keep a fifth category for traffic that needs more observation. This prevents a rushed block from breaking a mobile app, an API client, a monitoring service, or a search engine.
2. Filter requests before WordPress runs
The most effective enforcement point is normally the edge. A reverse-proxy firewall accepts an Internet request, evaluates it, and forwards only allowed traffic to the hosting server. WordPress describes the arrangement this way: “A website firewall can also be added as intermediary between the traffic from the internet and your hosting server.”
Because denied requests stop at the proxy, they do not consume the origin’s PHP workers, WordPress bootstrap, plugin hooks, or database connections. If the site is not already behind a reverse proxy, evaluate a CDN/WAF service such as Cloudflare or Sucuri, subject to your hosting, privacy, DNS, and budget requirements.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Use narrow edge rules first
- Open the provider’s bot analytics and identify a path, source, or rate pattern that is clearly abusive.
- Create a narrowly scoped custom rule for that condition. Start with a challenge, temporary block, or rate limit when the evidence is incomplete; use a hard block when the traffic is unambiguously hostile.
- Exclude verified crawlers and documented integrations before deploying the rule.
- Deploy in a mode that provides logs or counts, then inspect matches for false positives.
- Record the rule’s purpose, owner, date, exceptions, and rollback action.
Do not create a single rule that blocks all non-browser user agents or every request from a country. Those shortcuts create false positives and are difficult to troubleshoot. A path-plus-rate condition, combined with a verified exception, is usually more precise.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →3. Rate-limit the two most abused WordPress endpoints
/wp-login.php
Login pages are attractive to credential-stuffing tools because each attempt invokes authentication and may trigger security, logging, and notification plugins. Apply a limit at the edge or web server that allows normal administrator activity but slows repeated failures and bursts. Count requests by source address or another reliable client key, and decide what happens when the threshold is reached: delay, challenge, temporary block, or a response such as HTTP 429.
Do not rate-limit so aggressively that a team sharing one office network, VPN, or carrier-grade mobile address is locked out. If administrators use a known identity provider or a management network, document a narrowly scoped exception rather than exempting the whole Internet.
/xmlrpc.php
XML-RPC has historically been targeted for brute-force and amplification attempts. If your site does not use it, disable or block it at the edge or server. If it is required for Jetpack, a mobile application, publishing workflow, or another integration, do not disable it blindly. Instead, limit it and allow only the documented legitimate flows.
Test every exception after deployment. A rule that protects XML-RPC but silently breaks publishing, synchronization, or application login is not a successful mitigation.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Other expensive paths
Use your baseline to identify additional targets: uncached search results, faceted URL combinations, feed endpoints, comment submission, password-reset routes, REST API methods, or a plugin’s custom API. Rate-limit only the paths that show abusive behavior. Ordinary page requests should continue to work for humans and verified crawlers.
4. Keep Googlebot, Bingbot, and other legitimate crawlers working
Anti-bot controls can create crawl errors when they challenge or block a real search crawler. Cloudflare documents verified bots, including Googlebot and Bingbot, and provides controls intended to distinguish them from clients that merely claim to use those names.
Do not trust the user-agent string alone. Use the provider’s verified-bot mechanism when available, or independently validate crawler identity according to the crawler’s published process before granting an exception. Keep the exception as narrow as the rule: a verified crawler should not automatically bypass every security control on every path.
Review crawl-related status codes after a change. Unexpected challenges, timeouts, 403 responses, or 429 responses on public content are warning signs. Cloudflare also warns that blocking Google user agents in .htaccess, server configuration, or robots.txt can cause crawling problems.
Recommended Free Tools
5. Use robots.txt for guidance, not security
robots.txt is a cooperative signal. It can ask compliant crawlers not to fetch low-value areas such as internal search results, faceted combinations, duplicate parameter URLs, or administrative paths. A hostile client can ignore the file, so it cannot stop scraping, login attacks, or resource exhaustion.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
When it helps
- Reduce unnecessary crawling of URL patterns that have little search value.
- Keep crawl discovery focused on canonical, indexable content.
- Give well-behaved crawlers a clear policy before they request expensive pages.
When it is the wrong control
- Never use it as the only protection for
/wp-login.php,/xmlrpc.php, private files, or an API. - Do not list sensitive paths as a substitute for authentication; the file is publicly readable.
- Do not disallow a path merely because an abusive client used it. Enforce abuse with the WAF, web server, or application.
For low-quality pages that should not appear in search, WordPress’s SEO guidance prefers a page-level noindex directive. Blocking a crawler in robots.txt can prevent it from fetching the page and seeing that directive, so choose the control according to whether the goal is crawl reduction or index exclusion.
6. Add web-server controls when edge filtering is unavailable
A web server can reject or throttle requests before WordPress loads. This is still closer to the origin than an edge firewall, but it avoids much of the PHP and plugin overhead. Ask your host which controls are available for per-path rate limiting, connection limits, request timeouts, IP or network blocks, and access-log sampling.
Use the same narrow logic as at the edge: protect login and XML-RPC, target demonstrated abusive paths, preserve verified crawler exceptions, and test from a real administrator session. Keep configuration in versioned or documented form so a future host migration does not erase the protection.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Web-server rules can also conflict with caching, load balancers, health checks, SSO callbacks, or IPv6 addressing. Confirm that the rule sees the real client address rather than only the proxy’s address, and verify that trusted-proxy settings cannot be spoofed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Use a WordPress plugin only as a fallback
A plugin is useful when you cannot control the CDN, WAF, or web server, but it runs on or near the origin. A request may consume web-server resources and begin WordPress processing before the plugin can reject it. For that reason, application-level throttling is a fallback, not the preferred first line for a large flood.
Bottle
Bottle is listed in the official WordPress plugin directory and states that it can terminate WordPress processing when a throttle condition is reached. Before enabling it, check its current compatibility, update history, logging, exclusion controls, and behavior with logged-in users and scheduled tasks.
PSB Bot Traffic Controller
PSB Bot Traffic Controller is also listed in the official directory. Its description says it intercepts early through a must-use plugin and supports category and global rate thresholds. Early interception can reduce application work compared with a normal plugin hook, but it remains an origin-side control and still requires testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Plugin deployment checklist
- Install only from a source you can verify and keep a rollback copy of the previous configuration.
- Begin in logging or monitor mode if offered.
- Define exceptions for administrators, APIs, Jetpack, mobile apps, SSO, uptime monitors, and scheduled jobs that your site actually uses.
- Watch PHP workers, database load, response times, 5xx errors, and blocked-request logs during the first busy period.
- Remove or replace a plugin that is abandoned, incompatible with your WordPress version, opaque about its limits, or generating false positives.
8. Compare the available enforcement points
| Option | Where it enforces | Verified crawler handling | Rate-limit precision | Origin impact | Main compatibility concern | Cost or availability |
|---|---|---|---|---|---|---|
| CDN or reverse-proxy WAF | Before the hosting server | Can provide verified-bot controls; implementation varies by provider | Usually supports path, source, and request-rate rules | Lowest for denied requests | DNS, proxying, cache behavior, privacy, and proxy-aware logging | Plan and feature availability vary; no universal figure is established here. |
| Web-server rules | At the origin web server | Requires deliberate identity validation and exceptions | Can be precise by path, address, connection, or rate | Lower than WordPress, but higher than an edge block | Load balancers, IPv6, trusted-proxy settings, health checks, and host-specific syntax | Depends on hosting access; no universal price is stated. |
| WordPress plugin | During or before WordPress execution | Depends on the plugin and your configuration | May support global, category, or plugin-defined thresholds | Highest of these options because requests reach the origin | Plugin conflicts, updates, logged-in sessions, APIs, XML-RPC, and false positives | Program availability and pricing vary; the official directory lists examples. |
9. A practical rollout sequence
- Measure. Save bot analytics, access logs, cache status, response codes, request rates, and PHP or CPU readings for a representative before window.
- Map dependencies. List every legitimate caller that uses login, XML-RPC, REST, feeds, webhooks, SSO, Jetpack, mobile publishing, or scheduled tasks.
- Choose the highest enforcement point available. Prefer a reverse proxy, then the web server, then WordPress.
- Protect login and XML-RPC. Disable XML-RPC only when it is genuinely unused; otherwise rate-limit it and document narrow exceptions.
- Deploy one narrow rule. Target the abusive path, source, or rate pattern shown in your baseline instead of creating a global bot ban.
- Preserve verified crawlers. Use verified-bot controls or validated identity checks and inspect public-content responses after deployment.
- Add crawl guidance. Update
robots.txtfor cooperative crawlers and use page-levelnoindexwhen the goal is index exclusion. - Observe and compare. Repeat the same measurements after the change. Look for lower uncached origin requests and healthier PHP and CPU metrics, not just a lower request count at the edge.
- Roll back safely. If legitimate users receive challenges, 403s, 429s, timeouts, or publishing failures, disable the newest rule, restore the previous configuration, and review the exception rather than widening a blanket allow-list.
10. Troubleshoot common failure modes
Google traffic falls after a rule change
Check crawler-specific status codes, challenge events, and the exact rule that matched. Remove any blanket user-agent, country, or non-browser block, then restore a verified-crawler exception. Confirm that robots.txt was not changed to disallow the affected content.
Administrators are locked out
Inspect whether a shared office, VPN, or mobile carrier address exceeded the login threshold. Add a narrow administrative or SSO exception, reduce the scope of the rule, and keep protection for repeated failures from other sources.
Jetpack or a mobile app stops publishing
Determine whether the integration uses XML-RPC or another API path. Permit only the documented service flow, keep rate limits in place, and test publishing, synchronization, and authentication end to end.
The server is still overloaded after blocking bots
Check whether the rule is running in WordPress rather than at the edge, whether the requests are cache misses, and whether another expensive path is responsible. Examine PHP and database metrics, then move the control closer to the edge or web server and target the newly identified path.
Logs show every request coming from the proxy
Correct the trusted-proxy and real-client-IP configuration before making IP-based decisions. A misconfigured address chain can cause you to block the proxy, exempt attackers, or rate-limit every visitor together.
11. Maintain the system after the first fix
- Review bot analytics and origin logs on a schedule, and after major content, plugin, hosting, or DNS changes.
- Re-test login, XML-RPC or API integrations, caching, contact forms, feeds, and search-crawler access after changing limits.
- Keep an inventory of every exception with its owner, reason, scope, and review date.
- Watch for new URL patterns, rotating networks, forged user agents, and bursts that evade a rule written for a single IP.
- Remove obsolete blocks and exceptions. A growing list of permanent exceptions is a sign that the rule is too broad or the architecture needs redesign.
The objective is not to make the request count reach zero. It is to stop clearly abusive work before it reaches WordPress while allowing real visitors, verified crawlers, and the integrations your site depends on to continue operating.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
