The reliable way to stop malicious WordPress bots is layered defense: filter automation at an edge WAF/CDN, limit expensive requests at the web server, harden WordPress authentication, patch every component, watch logs, and keep tested backups. No single plugin, IP list, or hidden login URL can protect both the site and the VPS by itself.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a bot attack can do to WordPress and the VPS
Automated traffic is not automatically malicious. Search crawlers, uptime monitors, API clients, scheduled jobs, and services such as Jetpack may all make legitimate requests. The problem is traffic that repeatedly guesses passwords, probes vulnerable files, abuses XML-RPC, consumes PHP workers, or turns a small WordPress compromise into access to the underlying server.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Most attacks concentrate on a few high-value paths. wp-login.php receives credential-stuffing and brute-force attempts. xmlrpc.php can be abused for password spraying or request amplification when it is not required. Unauthenticated search, export, preview, or poorly designed plugin endpoints can force database queries and exhaust CPU before a request is rejected. A successful administrator login can lead to malicious plugins, altered themes, spam pages, new privileged users, or theft of the VPS credentials used to maintain the site.
Defenses should therefore be placed in order of cost. Stop obvious automation before it reaches the origin, reject or slow suspicious requests at the web server, then make the application and administrator accounts resilient when a request gets through.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The layered design that protects the origin
| Layer | Acts on | Useful signals | Why it matters | Typical controls |
|---|---|---|---|---|
| Edge WAF/CDN | Before the VPS | IP reputation, managed signatures, bot score, geography, request rate, verified crawler identity | Blocks or challenges traffic without spending origin CPU, PHP workers, or database connections | Managed rules, bot analytics, challenge pages, Turnstile, targeted rules for login and XML-RPC |
| Web server | At Nginx or Apache on the VPS | Endpoint, response code, request rate, connection behavior, cookies | Protects the origin when traffic bypasses the edge and limits expensive paths | Per-endpoint rate limits, request-size and timeout limits, ModSecurity with OWASP CRS |
| WordPress | Inside the application | Failed authentication, role changes, plugin behavior, XML-RPC use | Reduces the chance that a successful request becomes a site takeover | Updates, least privilege, unique passwords, 2FA, WebAuthn/passkeys, plugin removal |
| VPS and network | Operating system, SSH, firewall, logs | Repeated login failures, unusual processes, port scans, file changes | Limits movement from WordPress into the server and makes incidents visible | Patch management, minimal exposed ports, encrypted administration, centralized logs, Fail2ban |
| Recovery | Backups and restore process | Backup age, integrity, restore time, clean recovery credentials | Makes a successful intrusion or destructive action survivable | Offline or isolated copies, scheduled restore tests, documented access recovery |
Use several layers with different failure modes. An edge block that is misconfigured should not be the only thing preventing a compromise; conversely, a WordPress plugin should not be expected to absorb a flood that has already consumed the VPS resources.
Establish a baseline before blocking traffic
Spend several days observing normal behavior before setting aggressive limits. Record which administrators sign in, how often cron runs, which APIs are used, whether Jetpack or another integration calls XML-RPC, and which search crawlers are legitimate for your site. Include routine traffic from monitoring services and deployment tools.
Review web-server access logs and the WAF’s analytics for:
- Requests to
wp-login.phpandxmlrpc.php, including status codes and request frequency. - Bursts of 403 or 404 responses that indicate probing for files or vulnerable plugins.
- Repeated requests from changing IP addresses but with the same user agent, cookie pattern, or behavior.
- Unexpected POST requests to unauthenticated endpoints and unusually expensive pages.
- Legitimate crawlers that should be challenged or allowed rather than blocked.
Export or retain enough logs to compare a rule change with its false positives. A rate limit that appears effective because it blocks every request is not a safe configuration if it also prevents administrators, APIs, cron jobs, or verified crawlers from working.
Put the domain behind an edge WAF/CDN
Verify the path before enabling enforcement
- Move DNS to the managed WAF/CDN according to its documented procedure.
- Confirm that the certificate presented to visitors is valid and that the origin certificate and TLS mode are appropriate.
- Test the public site, administrator login, media uploads, REST API, scheduled jobs, and any external integrations.
- Confirm WordPress loopback requests. WordPress uses loopbacks for scheduled tasks and health checks; an edge rule that challenges the server’s own request can silently break those functions.
- Restrict direct origin access where practical. If the VPS remains reachable by its public address, an attacker can bypass edge controls and attack the origin directly.
Start with managed rules and visibility
Enable the provider’s managed WAF rules and bot analytics, then inspect matches before adding custom blocks. A bot score or equivalent risk signal is more useful than a permanent block on a single country or address range. Networks rotate addresses, and legitimate visitors can share an address with abusive traffic.
Challenge suspicious automation rather than blocking all unknown clients. A browser challenge or Turnstile-style verification can separate ordinary visitors from scripts while preserving a path for a real person. Allow verified search crawlers only when their identity can be validated; a user-agent string by itself is not proof.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Create narrow rules for the high-risk endpoints
Apply targeted controls to /wp-login.php, /xmlrpc.php, and any expensive unauthenticated endpoint. Use bot score, request rate, response behavior, and authentication context together. For example, repeated failed responses can trigger a challenge or temporary block, while a normal administrator session remains allowed. Cookie-based counting can help when one bot network rotates IP addresses, but it should not replace per-IP and per-identity controls.
Cloudflare’s documentation describes bot-score controls, WordPress loopback optimization, Turnstile/WAF layering, and response-code-based rate rules as separate tools that can be combined. Its rate-limiting guidance identifies login protection against credential stuffing as a typical use case. The exact controls and plan limits vary, so verify the labels and limits shown in your account.
Rate-limit WordPress without locking out real users
Rate limiting is a behavior control, not a universal number. Set a limit per endpoint, then observe legitimate administrators, API clients, cron jobs, and integrations. Keep a log-only or challenge mode while tuning where the platform supports it.
| Endpoint or behavior | Primary risk | Safer control | What to verify |
|---|---|---|---|
wp-login.php |
Password guessing and credential stuffing | Per-IP and per-account attempt limits, challenge after repeated failures, temporary bans | Administrators can sign in after a mistyped password and can recover from a lockout |
xmlrpc.php |
Password spraying, pingback abuse, high request volume | Disable when unused; otherwise allow only required methods or trusted integrations and rate-limit POST requests | Jetpack, mobile clients, publishing tools, and webhooks still function if needed |
| Unauthenticated search, preview, export, or API paths | CPU, database, and PHP-worker exhaustion | Cache where safe, impose concurrency and request-rate limits, require authentication for sensitive operations | Normal visitors and documented API clients are not challenged continuously |
| Repeated 403/404 probes | Scanner traffic and log noise | Short-lived challenge or ban after a behavioral threshold | A broken link or deployment check does not create a lasting block |
Use temporary actions. A short challenge or ban gives you time to investigate without creating an unmaintainable permanent blocklist. If one address repeatedly fails and then succeeds, investigate the account and credentials rather than assuming an IP ban solved the problem.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHarden administrator authentication
Administrator accounts are the most direct route from a bot request to a full site compromise. Do not rely on changing or hiding the login URL: scanners can discover alternate paths, and hiding the URL does not strengthen a stolen password.
- Give every user a unique, long password. Never reuse a WordPress password for SSH, hosting, email, or a password manager’s master account.
- Remove unused accounts and legacy users, including generic administrator names that no longer have an owner.
- Use the lowest role that permits a person to do their job. Editors and authors should not have administrator privileges.
- Require multi-factor authentication for every administrator. Where supported, prefer WebAuthn or a FIDO2 security key because the cryptographic origin binding resists phishing; app-based one-time codes are a useful alternative when a security key is not practical.
- Review alerts for failed logins, new users, role changes, password resets, and changes to authentication settings.
- Keep an emergency recovery account documented and protected, rather than creating shared administrator credentials.
Test the recovery path before enforcing a new factor. Record who controls the security key, where backup keys are stored, and how an administrator can regain access if a device is lost.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Decide whether XML-RPC should remain enabled
If no integration requires XML-RPC, disabling it removes an exposed endpoint. If Jetpack, a mobile publishing client, or another documented integration needs it, blocking the entire file will break that service. In that case, keep it available only through the required methods or trusted path and apply strict rate limits and monitoring.
Check actual logs before making the decision. A request to xmlrpc.php is not proof that a legitimate service is in use. Document the integration, its expected frequency, and the account it uses. Re-test publishing, remote comments, and scheduled operations after every rule change.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHarden the VPS and web server
Patch the complete stack
Keep WordPress core, every active theme and plugin, the operating system, PHP runtime, database, Nginx or Apache, and security components current. Remove abandoned or unused plugins instead of leaving them disabled. Subscribe to security advisories and schedule maintenance so updates do not depend on remembering them after an incident.
Reduce the exposed attack surface
- Expose only the ports required for web traffic and documented administration.
- Administer over encrypted SSH or SFTP, using key authentication where possible; disable unused accounts and avoid direct root logins.
- Separate deployment credentials from WordPress administrator credentials.
- Set conservative request-body, upload, connection, and execution limits appropriate to the site, then test media uploads and legitimate API calls.
- Use filesystem permissions that let the web process write only where necessary. A writable entire application tree makes a plugin compromise more damaging.
- Keep database credentials out of publicly served files and rotate them after a suspected compromise.
Consider server-side inspection
ModSecurity with the OWASP Core Rule Set can detect and block common malicious patterns at the server layer. It is not a substitute for patching or an edge WAF, and rules can create false positives for editors, APIs, and ecommerce workflows. Run new rules in detection or audit mode, review matches, then enforce narrowly.
Use logs and Fail2ban for temporary response
Centralize WAF, web-server, WordPress authentication, SSH, firewall, and system logs. Retain timestamps, source addresses, requested paths, response codes, authenticated identity when available, and the rule that acted. Protect logs from alteration by the compromised web process and restrict access to them.
Fail2ban or an equivalent tool can watch repeated failures and add a temporary firewall ban. Create separate jails for SSH and WordPress-related patterns rather than one broad rule. Set an allowlist process for trusted monitoring, office addresses, and verified services, and make sure the allowlist is reviewed when staff or infrastructure changes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Temporary bans are preferable to permanent IP or country blocklists. They expire, adapt to changing networks, and reduce the chance that a shared address permanently locks out a legitimate visitor. A ban should trigger investigation when the pattern is new, persistent, or associated with a successful login.
Monitor for signs that a bot succeeded
Alert on changes that ordinary traffic controls cannot explain:
- A new administrator, unexpected role change, or password reset.
- Successful logins after a burst of failures, especially from a new location or device.
- New or modified plugins, themes, PHP files, scheduled tasks, or server users.
- Unexpected outbound mail, redirects, cryptocurrency-mining processes, or sustained CPU usage.
- Database changes that add spam links, hidden users, or unfamiliar options.
- WAF rules repeatedly firing against an authenticated session.
Correlate timestamps across edge, web, WordPress, SSH, and operating-system logs. A single failed request is rarely actionable; a sequence that moves from probing to authentication to file change is an incident.
Backups and the recovery plan
Assume that one bot will eventually get through. Maintain multiple backup copies that are isolated from the VPS, include the database and uploaded media, and are protected from deletion by the same credentials used to administer the site. Keep enough history to recover from a compromise that was discovered days after the initial change.
- Define who can declare an incident and who can disable an edge rule or restore service.
- Preserve relevant logs and the current compromised system for investigation before wiping evidence.
- Revoke WordPress, database, SSH, deployment, API, and WAF credentials that may have been exposed.
- Rebuild or clean the VPS from a known-good source rather than trusting files on a compromised server.
- Restore a verified backup, patch every component, remove the original access path, and require new multi-factor credentials.
- Test public pages, administrator access, cron, APIs, email, and monitoring before reopening traffic.
Perform scheduled restore tests. A backup that has never been restored is an assumption, not a recovery plan.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing where to invest effort
| Option | Best at | Origin-resource effect | False-positive controls | Operational trade-off |
|---|---|---|---|---|
| Managed edge WAF/CDN | Filtering reputation, bot score, signatures, and volume before the VPS | Usually lowest origin impact | Challenges, allowlists, verified-bot handling, per-path rules | Requires DNS/TLS validation, rule tuning, plan limits, and provider access recovery |
| Nginx or Apache limits | Protecting specific paths and connections at the origin | Some connection and web-server cost remains; PHP and database work can be reduced | Per-endpoint policies, logs, exceptions for APIs and cron | Configuration errors can affect the whole site and must be deployed carefully |
| WordPress security controls | Authentication, roles, plugin exposure, and application behavior | Requests have already reached WordPress | Account-level rules and integration-specific exceptions | Cannot protect an unpatched server or absorb a traffic flood alone |
| Fail2ban and firewall | Repeated authentication failures and server-level abuse | Acts after log generation, before later connections | Temporary bans and explicit allowlists | Needs reliable log parsing and an emergency unban procedure |
| Backups and rebuilds | Recovery after compromise or destructive activity | Does not stop an attack | Restore validation and clean credential rotation | Consumes storage and administration time but determines survivability |
WordPress’s Advanced Administration guidance specifically recommends managed WAF controls for bot management and login-specific rules, and suggests ModSecurity rulesets such as OWASP CRS for server-side brute-force detection. Its hosting guidance also recommends throttling both maximum logins per site over time and maximum attempts per IP across the infrastructure.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common failure modes and fixes
“I changed the login URL, but bots continue.”
Keep the URL change only as a minor noise-reduction measure. Enforce unique credentials, multi-factor authentication, endpoint rate limits, monitoring, and temporary bans; scanners can discover alternate login routes and leaked links.
Recommended Free Tools
“A blanket XML-RPC block broke publishing.”
Identify which integration uses the endpoint, then allow the required traffic and rate-limit it. If no integration is needed, disable XML-RPC and confirm that scheduled tasks and ordinary administrator work still function.
“The WAF is on, but CPU is still high.”
Check whether the attacker is reaching the origin address directly, whether the rule is only challenging after WordPress executes, and whether expensive paths lack server-side limits. Restrict origin access, move enforcement earlier, and inspect PHP-worker and database metrics.
“Legitimate crawlers or administrators are blocked.”
Compare the rule match with the baseline, verify crawler identity rather than trusting a user-agent string, and create the narrowest allowlist or challenge exception. Do not disable all bot protection to solve one false positive.
“Fail2ban locked out the only administrator.”
Use a documented console or out-of-band recovery path, remove the temporary ban, add a carefully controlled administrative allowlist, and lower the rule’s aggressiveness. Keep a second protected administrator and backup authentication method.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A practical operating runbook
- Days 1–3: Baseline login, XML-RPC, API, cron, crawler, response-code, CPU, PHP-worker, and database behavior.
- Day 4: Place the domain behind the edge WAF/CDN; verify DNS, TLS, loopbacks, origin reachability, and all integrations.
- Week 1: Enable managed rules and analytics. Challenge suspicious automation and allow verified crawlers where justified.
- Week 1: Add narrow limits for
wp-login.php, XML-RPC, and expensive unauthenticated paths. Log matches and review false positives. - Week 2: Remove unused accounts and components, enforce least privilege, deploy multi-factor authentication, and document recovery keys.
- Week 2: Patch WordPress, themes, plugins, PHP, the web server, database, and operating system; remove abandoned software.
- Week 3: Centralize logs, configure temporary Fail2ban actions, test the allowlist and emergency unban path.
- Every scheduled interval: Test backup restoration, review authentication and privilege-change alerts, and retune limits as traffic changes.
This sequence protects scarce VPS resources first, then reduces the chance that an authenticated request becomes a WordPress or server takeover. It also gives you a measurable way to roll back a rule without losing administrator access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
