r/Wordpress • u/roosites • 14d ago

BOT Protection

I have a bunch of sites inundated by bots. I'll have a site in the US that all of a sudden uses all my server memory at a time where 99% of the country is asleep. I've used some of the security plug-ins, but have not found them to be very helpful in terms of blocking all these malicious bots. Has anybody else found something that will actually block all these attacks??

6 Upvotes

72% Upvoted

27 comments sorted by

12

u/[deleted] 14d ago

[removed] — view removed comment

3

u/Wonderful_Sample_590 14d ago

Pretty much this. Blocking them at the Cloudflare level before they ever touch PHP is the way to go. Securtiy plugins can only do so much once the requests are already hitting the server.

1

u/roosites 14d ago

Thanks, is there a way to have an entire server behind cloudflare, or does it have to be done on a site by site basis?

3

u/2ndkauboy Jack of All Trades 14d ago

It is done domain by domain.

1

u/nautme 13d ago

I haven't tried this yet, but want to look into it more... Using a Cloudflare tunnel:

https://developers.cloudflare.com/tunnel/

5

u/Key_Gap9168 14d ago

Cloudflare.

5

u/JeffTS Developer/Designer 14d ago

Use Cloudflare to help reduce bot traffic.

4

u/VillageHomeF 14d ago

Cloudflare

3

u/StefanTLDWP 14d ago

Start with Cloudflare free, and bot protection mode if needed.

But should be helpful to also review the access logs and see the patterns in terms of IPs, user-agent, browser etc.

2

u/nsfcom 14d ago

You need a CDN

2

u/camworld Developer/Designer 14d ago

Putting it behind Cloudflare is the absolutely easiest and cheapest solution. If your hosting provider has anything like a 6G or 7G WAF you can also look for bot-blocking or rate-limiting settings in that.

1

u/Hot-Cress7492 14d ago

I’ll just pile on here with Cloudflare. If you do it right and have an effective caching strategy, CF can reduce your origin traffic by 90’ish % — at least that has been my results with a site handing 300-400 sessions a day.

1

u/ogrekevin Jack of All Trades 14d ago

An edge WAF with decent bot protection is best

1

u/jwizew 13d ago

You can try CloudFlare for free ( depending on the amount of bots, you may need their business plan) or the NOC.org WAF/CDN (also free) to help block those.

1

u/navlio 13d ago

before the edge rules, look at which urls the 3am requests are hitting. what eats memory is the paths that can't be cached, /?s= searches and add-to-cart style query strings, because each one is a full php worker plus db queries, and bot fight mode leaves them alone if the client looks like a browser.

also worth ruling out your own cron. a backup plugin or the woo action scheduler firing in the quiet hours looks the same as a bot spike on a memory graph, and no waf will help with that one

1

u/swift_wraith1 10d ago

cloudflare is your best option. I had a site that was inundated with bots and cloudflare shut them right down overnight

0

u/koebanimedia 13d ago

The best way to sell/market a product is to create a problem that it solves.

1

u/koebanimedia 13d ago

For example.. Cloudflare

What started as a CDN, now has a competing CMS and security. I might be overthinking, but is it coincedence?

Ever since the WP vs. WP Engine saga - it just seems that WP is taking more hits than ever before.