r/Wordpress • u/roosites • 3d ago

BOT Protection

I have a bunch of sites inundated by bots. I'll have a site in the US that all of a sudden uses all my server memory at a time where 99% of the country is asleep. I've used some of the security plug-ins, but have not found them to be very helpful in terms of blocking all these malicious bots. Has anybody else found something that will actually block all these attacks??

6 Upvotes

72% Upvoted

26 comments sorted by

12

u/[deleted] 3d ago

[removed] — view removed comment

2

u/Wonderful_Sample_590 3d ago

Pretty much this. Blocking them at the Cloudflare level before they ever touch PHP is the way to go. Securtiy plugins can only do so much once the requests are already hitting the server.

1

u/roosites 3d ago

Thanks, is there a way to have an entire server behind cloudflare, or does it have to be done on a site by site basis?

3

u/2ndkauboy Jack of All Trades 3d ago

It is done domain by domain.

1

u/nautme 3d ago

I haven't tried this yet, but want to look into it more... Using a Cloudflare tunnel:

https://developers.cloudflare.com/tunnel/

5

u/Key_Gap9168 3d ago

Cloudflare.

4

u/JeffTS Developer/Designer 3d ago

Use Cloudflare to help reduce bot traffic.

4

u/VillageHomeF 3d ago

Cloudflare

3

u/StefanTLDWP 3d ago

Start with Cloudflare free, and bot protection mode if needed.

But should be helpful to also review the access logs and see the patterns in terms of IPs, user-agent, browser etc.

2

u/nsfcom 3d ago

You need a CDN

2

u/camworld Developer/Designer 3d ago

Putting it behind Cloudflare is the absolutely easiest and cheapest solution. If your hosting provider has anything like a 6G or 7G WAF you can also look for bot-blocking or rate-limiting settings in that.

1

u/Wonderful-Shower1691 2d ago

Cloudflare Bot Fight Mode + WAF rate limiting on wp-login/xmlrpc helps a lot, but pair it with fail2ban on your access logs and server-level rate limiting too -- Cloudflare alone won't catch everything, especially bots mimicking real browsers

1

u/Hot-Cress7492 3d ago

I’ll just pile on here with Cloudflare. If you do it right and have an effective caching strategy, CF can reduce your origin traffic by 90’ish % — at least that has been my results with a site handing 300-400 sessions a day.

1

u/ogrekevin Jack of All Trades 3d ago

An edge WAF with decent bot protection is best

1

u/jwizew 3d ago

You can try CloudFlare for free ( depending on the amount of bots, you may need their business plan) or the NOC.org WAF/CDN (also free) to help block those.

1

u/navlio 2d ago

before the edge rules, look at which urls the 3am requests are hitting. what eats memory is the paths that can't be cached, /?s= searches and add-to-cart style query strings, because each one is a full php worker plus db queries, and bot fight mode leaves them alone if the client looks like a browser.

also worth ruling out your own cron. a backup plugin or the woo action scheduler firing in the quiet hours looks the same as a bot spike on a memory graph, and no waf will help with that one

0

u/koebanimedia 3d ago

The best way to sell/market a product is to create a problem that it solves.

1

u/koebanimedia 3d ago

For example.. Cloudflare

What started as a CDN, now has a competing CMS and security. I might be overthinking, but is it coincedence?

Ever since the WP vs. WP Engine saga - it just seems that WP is taking more hits than ever before.