What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Put your WordPress site behind Cloudflare, preserve verified bots first, then use Cloudflare’s bot controls, score-based rules, path-specific WAF rules and rate limiting in stages. Start in observation mode, block traffic that is definitely automated, challenge traffic that is only likely to be automated, and check WordPress publishing, loopbacks, scheduled tasks and APIs after every change.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This layered approach stops scraping and vulnerability scans without treating every crawler as hostile. Cloudflare’s feature availability depends on your plan, and the 1–99 Bot Management score is an Enterprise add-on.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What “bad bots” means on a WordPress site
A bot is simply software making HTTP requests. Search crawlers, uptime monitors, accessibility checkers and deployment systems can be useful bots; scrapers, credential-stuffing scripts, vulnerability scanners and spam submitters are not. The objective is selective filtering, not blocking every request that lacks a human-operated browser.
WordPress attracts automated traffic because common files and endpoints are easy to discover. Attackers repeatedly probe /wp-login.php, /xmlrpc.php, administrative paths, plugin routes and public APIs. Scrapers may request large numbers of posts or media files without attempting a login. A rule that blocks all automation can stop Googlebot, Bingbot, monitoring services, WordPress loopback requests or an integration your site depends on.
#1 Best Overall
Cloudflare makes the decision at the edge, before a request reaches WordPress. That reduces origin load and lets you apply different actions to different request types: allow, skip selected protections, issue a Managed Challenge, rate-limit or block.
Before changing a rule: verify the site is using Cloudflare
Cloudflare protections apply only to traffic that passes through Cloudflare’s proxy. Confirm that the WordPress hostname is active in Cloudflare and that the DNS record serving the site is proxied. If a hostname is DNS-only, its requests go directly to the origin and Cloudflare bot rules cannot inspect or stop them.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMake a list of services that must continue to reach the site. Include search crawlers, uptime monitoring, payment or membership integrations, publishing tools, mobile apps, webhooks, remote backups and any service that calls a WordPress API. You will use that list when reviewing logs and testing rules.
Use traffic evidence before blocking anything
Open Cloudflare’s Bot Analytics and review the traffic that is actually reaching the site. Look for request volume, paths, countries, user-agent patterns, response codes and whether traffic is classified as verified, definitely automated or likely automated. Cloudflare recommends starting with a small threshold and increasing it gradually as you learn how much automation your site can tolerate.
What to record during the observation period
- The busiest automated paths, especially login, XML-RPC, API and search endpoints.
- Traffic that repeatedly returns 404, 401, 403 or 5xx responses.
- Requests that use many accounts, query strings or user-agent strings from the same source pattern.
- Verified crawler and monitoring traffic that must remain available.
- Normal peaks caused by publishing, releases, newsletters, game launches or scheduled jobs.
Do not choose a rate or score threshold from a single busy minute. A quiet site and a news site have very different normal traffic. Keep the first change narrow enough that you can identify which rule caused a problem.
Preserve verified bots before broad bot controls
Create the exception for verified automation before adding broad blocks or challenges. Cloudflare’s example uses the expression (cf.bot_management.verified_bot) with a Skip action. Verified bots include examples such as Googlebot, Bingbot and monitoring services that Cloudflare can authenticate as legitimate.
Recommended Free Tools
How to create the verified-bot exception
- In the Cloudflare dashboard, open the site’s security rules area and create a custom WAF rule.
- Set the expression to
(cf.bot_management.verified_bot). - Choose Skip rather than Allow. In the Skip configuration, select only the later controls that verified traffic must bypass, such as the bot products or managed rules that would otherwise challenge it.
- Place the exception ahead of broad bot rules and save it.
- Use Bot Analytics and request logs to confirm that known crawlers are being classified as verified and are no longer challenged.
Skip is powerful: depending on what you select, it can bypass later rate limiting, Super Bot Fight Mode and managed rules. Keep the bypass limited to verified traffic and to the products that are actually causing a false positive. A broad Skip rule for an IP range or user-agent string is not equivalent to Cloudflare’s verified-bot signal and can be spoofed.
Turn on Cloudflare’s built-in bot protections
Cloudflare’s bot settings provide maintained detections that change as Cloudflare adds signatures. The exact controls shown in the dashboard depend on the plan.
| Control or capability | Availability stated by Cloudflare | What it is useful for |
|---|---|---|
| Block AI bots | All plans | Blocks traffic classified as AI crawler traffic when the control is enabled. |
| JavaScript detections | All plans; automatic on Free | Adds a browser-side signal that helps distinguish scripted requests from normal browser traffic. |
| Definitely automated | Super Bot Fight Mode on Pro, Business and Enterprise | Blocks or otherwise handles traffic Cloudflare identifies as clearly automated. |
| Likely automated | Super Bot Fight Mode on Pro, Business and Enterprise | Challenges or handles traffic with weaker but concerning automation signals. |
| Verified bots | Super Bot Fight Mode on Pro, Business and Enterprise | Recognizes legitimate crawlers and services so they can be preserved. |
| Static resource protection | Super Bot Fight Mode on Pro, Business and Enterprise | Protects static assets from automated abuse where the feature applies. |
| Optimize for WordPress | Super Bot Fight Mode on Pro, Business and Enterprise | Allows WordPress loopback requests through bot protection. |
| Bot Management score and analytics | Enterprise paid add-on | Provides a 1–99 score, analytics and granular actions through WAF custom rules or Workers. |
Recommended order for built-in controls
- Keep the verified-bot exception in place.
- Enable the controls available on your plan, beginning with detection and challenge behavior rather than an aggressive site-wide block.
- Watch Bot Analytics and origin logs for false positives.
- Only then increase the strictness for clearly automated traffic.
Built-in settings require less maintenance than hand-written signatures because Cloudflare updates the underlying detections. They offer less control over one particular path or score boundary, which is where custom rules become useful.
Use Bot Management scores when your plan includes them
Cloudflare Bot Management assigns requests a score from 1 through 99. Cloudflare states that “A low score indicates that the request comes from a script, API service, or an automated agent.” The score is available through an Enterprise paid add-on, not as a universal Free-plan field.
Cloudflare’s documented baseline example blocks score 1 and applies a Managed Challenge to scores 2 through 29. That example is a starting point, not a guarantee that every site should use those boundaries.
Example score rules
| Score condition | Example action | Reason |
|---|---|---|
cf.bot_management.score eq 1 |
Block | Cloudflare’s example treats this as definitely automated. |
cf.bot_management.score ge 2 and cf.bot_management.score le 29 |
Managed Challenge | Cloudflare’s example treats this range as likely automated. |
| Higher scores | Allow normal processing | Do not add a blanket challenge without evidence that your audience is being abused. |
Write the score expression in Cloudflare’s expression editor rather than copying a rule blindly between zones. Keep the verified-bot Skip rule ahead of score rules. Test logged-in administration, publishing and API clients from networks that resemble your real users; an automated integration can receive a low score even when it is authorized.
Protect the WordPress paths attackers actually abuse
A site-wide bot action is often too blunt. A custom WAF rule lets you apply a different action to a sensitive path, combine a path with a method or country condition, and use a custom score threshold where Bot Management is available.
/wp-login.php
Login is a common target for credential stuffing. A path-specific rule can challenge or rate-limit suspicious requests while leaving ordinary page views alone. Do not block every login request if editors, administrators or a single-sign-on service need it. Test the WordPress dashboard, failed-login handling and password-reset flow after activation.
/xmlrpc.php
XML-RPC may be required by a mobile client or publishing workflow, but it is also frequently probed. If your site does not use it, a narrow block or challenge can reduce noise. If it is required, protect it with a verified integration, an appropriate rate limit and monitoring rather than assuming that every request is malicious.
/api/ and other integration routes
APIs can be legitimate automation, so distinguish read-heavy scraping from an authenticated application. A custom rule can combine the path with request method, authentication-related characteristics or a bot score. Challenge pages are unsuitable for clients that cannot execute browser JavaScript; those clients need an authenticated, rate-limited path or a narrowly scoped exception.
Static files and search endpoints
Scrapers may request posts, feeds, images or search results at high volume. Protect the expensive endpoint rather than challenging the whole site. Static resource protection, where available, can address automated asset fetching, but confirm that caches, game clients and accessibility tools still receive required files.
Add rate limiting for request-volume abuse
Bot classification answers “what kind of requester is this?” Rate limiting answers “how many requests is this requester making?” Use rate limiting when the harm comes from volume, such as repeated login attempts, XML-RPC calls, API reads or expensive searches.
Design a rate-limit rule
- Choose one endpoint or a small related group instead of the entire site.
- Measure normal traffic in Bot Analytics and logs during busy periods.
- Set a request rate and counting window that allows legitimate bursts but reacts to sustained abuse.
- Choose a response that fits the client. A Managed Challenge may work for browsers; an API may need a block, a clear error response or an authenticated exception.
- Deploy the rule, then watch origin load, response codes and integration failures.
Rule order matters. When a rule blocks or challenges a request, later phases do not evaluate it. Conversely, a Skip action can bypass selected later controls, including rate limiting, Super Bot Fight Mode and managed rules. Put exceptions first, then targeted protections, and avoid selecting more skipped products than necessary.
Enable Optimize for WordPress and test loopbacks
Cloudflare lists Optimize for WordPress as a control that allows WordPress loopback requests through bot protection. Loopbacks are requests the site makes to itself for tasks such as scheduled publishing, health checks and certain plugin operations.
Enable the option when it is available on your plan, then test the functions your site uses:
- Publishing and updating a post while logged in.
- WordPress scheduled events and any server-side cron arrangement.
- The Site Health screen and loopback tests.
- REST API calls used by the editor, mobile apps or integrations.
- Webhooks, membership actions, comments and forms.
Optimize for WordPress is not a reason to skip every security control for every request. It addresses the loopback behavior; external integrations still need their own testing and narrowly scoped exceptions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rule ordering and exceptions: the details that cause surprises
Put exceptions before enforcement
A verified-bot Skip rule must run before the broad block or challenge that would catch it. The same principle applies to an authenticated integration that you have deliberately exempted from a path-specific rule.
Know what Skip bypasses
Skip is not identical to Allow. It tells Cloudflare to omit the products you select for that request. Because it can bypass rate limiting, Super Bot Fight Mode and managed rules, review the selected components as carefully as the expression itself.
Do not trust spoofable identity fields
User-agent text alone does not prove that a request came from a search engine. Prefer Cloudflare’s verified-bot classification. If you allow an integration by IP, keep the range current and limit the exception to the exact hostname and path it needs.
How to test without locking yourself out
- Keep an administrator session open in one browser and test from a separate private window or network.
- Change one rule or one setting at a time.
- Use Cloudflare security events to confirm the action, expression and matched path.
- Check WordPress logs and the origin’s access log for 4xx, 5xx and authentication errors.
- Run a real publishing test, a scheduled-event test and an API or webhook test relevant to your site.
- Leave the rule at its initial strictness long enough to observe normal traffic, then tighten it incrementally.
If a change causes an outage, disable or reorder the newest rule first, verify recovery, and then reintroduce a narrower expression. Keep a written record of the prior action and threshold so rollback does not depend on memory.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshooting common failures
Googlebot or another crawler is challenged
Check whether Cloudflare identifies the request as a verified bot. Confirm that the verified-bot Skip rule is enabled, placed before the enforcement rule and configured to bypass the product causing the challenge. Do not “fix” this by allowing every request that claims to be Googlebot.
Administrators cannot log in
Inspect the matched rule for /wp-login.php. Reduce the challenge scope, adjust the rate limit based on observed administrator traffic or create a narrowly scoped administrative exception. Test failed-login protection separately so an exception does not remove controls you still need.
The block works on pages but not on an API client
Browser challenges require a client capable of completing them. Replace the challenge with authentication and rate limiting for that API, or create a narrowly scoped exception for the legitimate integration. Confirm that the exception does not cover unrelated paths.
Scheduled posts or Site Health reports loopback errors
Verify Optimize for WordPress is enabled where available, then inspect security events for the loopback request. A custom rule, managed rule or rate limit may still be stopping it. Narrow the offending rule rather than disabling all bot protection.
Traffic remains high after enabling bot controls
Check whether the requests are reaching a DNS-only hostname, an unprotected subdomain or a path not covered by your rule. Also check whether a Skip rule bypasses rate limiting or whether the traffic is classified as likely rather than definitely automated. Use a path-specific rule for the expensive endpoint instead of repeatedly raising a site-wide threshold.
Legitimate visitors see too many challenges
Review the matched expression, geography, score distribution and browser signals. Cloudflare recommends starting small and increasing the bot threshold over time. Lower the scope, switch a block to Managed Challenge, or exempt a verified service only after confirming its identity.
Choosing the right control for each problem
| Problem | Best starting control | Why | Main trade-off |
|---|---|---|---|
| Clearly scripted site-wide traffic | Definitely automated setting or a low bot-score block | High precision against traffic Cloudflare identifies as automation. | A mistaken classification can deny a real client. |
| Uncertain automation from browsers | Likely automated setting or Managed Challenge | Lets a human demonstrate browser behavior instead of blocking immediately. | Challenges can break non-browser clients and add friction. |
| Credential stuffing on login | Path-specific rule plus rate limiting | Focuses enforcement on the abused endpoint. | Thresholds require tuning around legitimate administrator bursts. |
| High-volume API scraping | API-specific rate limiting and authentication | Controls volume without challenging every public page. | Clients need a response they can handle and a documented limit. |
| Search or monitoring crawler | Verified-bot exception | Preserves authenticated legitimate automation. | Only Cloudflare-verified traffic should receive the bypass. |
| WordPress self-requests failing | Optimize for WordPress and targeted rule review | Designed for loopback behavior. | External integrations may still need separate exceptions. |
Plan limitations you should account for
On all Cloudflare plans, the documented options include Block AI bots and JavaScript detections; JavaScript detections are automatic on Free. Cloudflare lists Super Bot Fight Mode controls for Pro, Business and Enterprise: Definitely automated, Likely automated, Verified bots, Static resource protection and Optimize for WordPress. Full Bot Management is an Enterprise paid add-on and supplies the 1–99 score, analytics and granular actions through WAF custom rules or Workers.
If a control is missing from your dashboard, do not substitute an expression that depends on an unavailable field. Use the plan’s built-in detections, path rules and rate limiting, or upgrade only when the additional precision and analytics justify it.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA maintenance routine that avoids false positives
- Review Bot Analytics after major content releases, migrations and traffic spikes.
- Check security events for blocked verified services and failed integrations.
- Revisit login, XML-RPC and API rate limits when usage changes.
- Remove temporary exceptions once the related integration or incident is over.
- Keep score thresholds and rule actions documented so another administrator can reverse them.
- When tightening a rule, change one variable at a time and watch for WordPress loopback, publishing and API failures.
Cloudflare’s maintained bot detections reduce signature upkeep; custom rules provide the precision needed for a particular WordPress path. The safest long-term setup combines both: preserve verified automation, use built-in classification for broad traffic, and reserve custom enforcement for endpoints where you can observe the consequences.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
