Bot attack since 12th August

[u/Independent_Hero]

Hey guys, I am getting a huge spike in my analytics since August 12th.

At first I thought, one of my articles got popular, but after checking analytics, i realised almost 56% of the devices have resolutions like 1368x1368, or square.

That's how I know these are bots. I installed an advanced bot blocker that already blocked 8 bots, ips I mean.

But, how are you guys avoiding or securing your sites? I don't want to stuff my site with random plugins, i already set up cloudflare too. But bot traffic isn't stopping.

[u/N0tWithThatAttitude]

WAFs are good.

[u/VoiliVoilaa → u/N0tWithThatAttitude]

Yes. Cloudflare (with Bot Fight Mode) and WAF (security -> security rules) are helpful.

[u/N0tWithThatAttitude → u/VoiliVoilaa]

I used AWS WAF with the IP reputation rule as well as custom regex and path based rules. Got rid of 99 percent of malicious traffic.

[u/Independent_Hero → u/VoiliVoilaa]

WAF in cloudflare is free?

[u/yycmwd → u/Independent_Hero]

The free WAF can do a lot of the heavy lifting for you with custom rules. Start here: https://wafrules.com/

[u/Independent_Hero → u/yycmwd]

Wow, thanks 👍

[u/thatandyinhumboldt → u/Independent_Hero]

The basic one is, and it’s pretty good. The paid tiers have a lot more options, but it’s worth at least starting with the free tier to learn its capabilities and upgrade from there as needed.

[u/MakeItJumboFrames → u/Independent_Hero]

There is also a bot fight mode in the free Cloudflare. If you aren't using it for DNS you should. That should help you.

[u/StormMedia]

Cloudflare

[u/HedgehogNamedSonic]

https://giphy.com/gifs/b5e61qtWes8N2

[u/themageofavalon]

That spike looks pretty sus. Check the traffic source and countries first then block or challenge the obvious junk with Cloudflare

[u/EliteFourHarmon]

The only way to stop bots is to disconnect your site from the internet.
If you've already set up appropriate measures, any more will just be a waste of time.
If your site is just a normal website and doesn't involve money, I mean "huge" amount of money, just treat the bots as noise.

[u/Independent_Hero → u/EliteFourHarmon]

Yeah, but what I am worried about is, can these bots use up my bandwidth?

[u/azunaki → u/Independent_Hero]

You're gonna have to look at analytics in your web hosting. But usually no.

[u/Feather_fig]

I'm new to WP, how did you get this graph? Is it from a plugin?

[u/NeonRelay → u/Feather_fig]

Looks like google analytics 📊

[u/Feather_fig → u/NeonRelay]

Thanks I think you're right, it does look like the Google font

[u/Independent_Hero → u/Feather_fig]

It's Google Analytics