Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsReduce WordPress bot load in this order: measure which requests reach your origin, block or rate-limit abusive traffic at a reverse-proxy firewall, protect /wp-login.php and /xmlrpc.php, preserve verified search crawlers, and use robots.txt only for cooperative crawl guidance. Add a WordPress plugin only when edge or web-server controls are unavailable.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This approach prevents wasted PHP work without treating every automated request as malicious. There is no universal bot percentage or guaranteed server-load reduction: the useful result is a measured change in your own origin requests, CPU, PHP work, response codes and cache behavior.
As an Amazon Associate I earn from qualifying purchases.
1. Measure the traffic before changing a rule
Start with evidence from your CDN or web-application firewall (WAF) bot analytics and your origin access logs. Changing several controls at once makes it impossible to tell whether a rule helped, broke a legitimate integration or merely shifted the traffic elsewhere.
Record a before-and-after baseline
Keep a representative window before deployment and the same kind of window afterward. A busy weekday and a quiet weekend can produce very different results, so compare like with like. Record:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Top user-agent strings, including their request counts and whether they identify a known crawler.
- Source IP addresses, autonomous-system or hosting-network information when your provider supplies it, and the geographic distribution that matters to your audience.
- Requested paths, with special attention to
/wp-login.php,/xmlrpc.php, REST API routes, search URLs, feeds, sitemaps, attachment pages and faceted or parameter-heavy URLs. - Requests per minute and bursts per second, not just the daily total.
- Response codes: 200, 3xx, 4xx and 5xx responses often reveal different problems.
- Whether each request was served from cache or required an origin fetch.
- Origin CPU, memory, PHP worker utilization, database load and upstream connection counts during the same periods.
Cloudflare’s documented workflow begins with bot analytics for this reason: first identify the clients and paths creating work, then select a control that addresses that behavior. A high request count is not automatically harmful if the response is cached at the edge; a smaller number of uncached, PHP-heavy requests can be much more damaging.
Separate automation from an outage
Correlate spikes in bot requests with PHP-FPM saturation, database wait time, slow-query logs and web-server queue depth. If origin metrics are normal while edge bandwidth is high, caching or bandwidth controls may be more appropriate than WordPress throttling. If a small set of paths causes most of the PHP work, target those paths instead of imposing a site-wide block.
2. Put enforcement in front of WordPress
The most effective place to reject abusive requests is before WordPress loads. WordPress describes the architecture this way: “A website firewall can also be added as intermediary between the traffic from the internet and your hosting server.” A reverse-proxy CDN or WAF accepts the request, evaluates it, and forwards only allowed traffic to the origin. Requests rejected there consume far less PHP and database capacity than requests that reach index.php.
Edge, web-server and WordPress controls
| Control point | What it can do | Origin impact | Best use | Trade-offs |
|---|---|---|---|---|
| CDN or reverse-proxy WAF | Apply IP, path, country, reputation, bot and request-rate rules before forwarding | Lowest; rejected requests never execute WordPress | Large bursts, abusive paths and public sites already using a proxy | Requires correct DNS and origin protection; rule syntax and pricing vary by provider |
| Web-server configuration | Reject or rate-limit at Nginx, Apache or an equivalent server before PHP | Low, although the server still accepts and evaluates the connection | Sites that control the host but do not use a CDN/WAF | Configuration access and safe rollback are required; identity checks can be difficult |
| WordPress plugin | Throttle, classify or terminate requests from inside the application stack | Higher; bootstrap, web-server work and sometimes PHP execution occur first | Shared hosting or environments without edge/server controls | Compatibility, maintenance and false positives can affect the whole site |
Cloudflare and Sucuri are examples of edge-security services that can sit between visitors and the origin. Whatever provider you use, begin with narrow custom rules and rate limits rather than a blanket “block bots” setting. Keep the origin address protected; otherwise an abusive client can bypass the proxy and send traffic directly to the server.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Use a staged rule rollout
- Start in a logging, preview or challenge mode when the provider supports it.
- Match one clearly abusive path, user-agent pattern or request-rate condition.
- Observe allowed, challenged and blocked requests in the provider’s events log.
- Promote the rule to an outright block only after confirming that normal visitors, APIs and integrations are unaffected.
- Document the rule’s purpose, match condition, action, owner and rollback procedure.
Do not use a user-agent string alone as proof of identity. Malicious clients can copy “Googlebot” or any other label. Combine behavior, path and rate signals, and use verified-bot features or independent identity validation for exceptions.
3. Rate-limit the login and XML-RPC endpoints
Brute-force attempts against /wp-login.php and /xmlrpc.php are common sources of avoidable PHP and database work. Apply endpoint-specific limits at the edge or web server so a burst is rejected before WordPress renders a login form or processes an XML-RPC method.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDesign a login limit that real users can pass
Use a per-IP or per-session threshold over a short window, with a temporary block, challenge or delay after the threshold. A shared corporate network, school, mobile carrier or VPN can put many legitimate users behind one address, so an extremely low global IP limit can lock out an entire group. Consider separate thresholds for failed attempts and successful logins, and log the reason for every action.
Do not rate-limit only by IP if attackers rotate addresses. Combine IP reputation, request rate, failed-login count, cookie or session signals and, where appropriate, a challenge. Avoid exposing whether a username exists; a limit should not turn the login endpoint into an account-enumeration oracle.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Decide whether XML-RPC is required
If your site does not use XML-RPC, disable it or reject requests to /xmlrpc.php before they reach PHP. If it is required, document the dependency and create the narrowest exception possible. Legitimate uses can include Jetpack, mobile applications and other integrations. Exempt only the verified flow, source or method that is needed; do not allow unlimited XML-RPC traffic merely because one integration exists.
Test publishing, media uploads, scheduled tasks, comments and any mobile workflow after changing the rule. A blanket XML-RPC block can appear successful while silently breaking an application or integration that still depends on it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Protect APIs without breaking caching
REST API and GraphQL-style endpoints may be public, authenticated or used by the front end. Classify them separately. Rate-limit expensive unauthenticated queries, preserve authenticated application traffic, and ensure that a challenge page is not returned to an API client that cannot execute browser JavaScript. Check cache status and response codes after every change.
4. Preserve legitimate search crawlers
Search engines are automated clients, but blocking them can remove pages from search results. Cloudflare identifies Googlebot and Bingbot as examples of verified bots and warns that anti-bot controls can create crawl errors. Treat “bot” as a category to investigate, not a reason to block every automated request.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Use verified-bot controls where available
Prefer a provider’s verified-bot mechanism or independently validate crawler identity before allowing an exception. A user-agent header is only a claim. Validation can involve reverse-DNS and forward-DNS checks or a provider-maintained verification service; use the method supported by your infrastructure and keep it current.
Do not block Google user-agent strings in .htaccess, server configuration or robots.txt simply because other bots are abusive. A rule that matches a broad string such as “bot” can also catch legitimate crawlers, uptime monitors, accessibility tools or your own monitoring system.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Check crawl behavior after deployment
- Review WAF events for verified crawler requests and their response codes.
- Check server logs for repeated 403, 429 or challenge responses on sitemap, canonical and important content URLs.
- Use search-console crawl or URL-inspection diagnostics where applicable.
- Confirm that your sitemap, feeds and essential public pages remain reachable without an interactive challenge.
5. Use robots.txt for guidance, not security
robots.txt is a cooperative signal. It can ask compliant crawlers not to fetch low-value areas such as internal search results, faceted combinations or duplicate parameter URLs. A hostile client can ignore the file, so it cannot stop scraping, brute force or denial-of-service traffic.
Choose crawl guidance carefully
WordPress’s SEO guidance favors page-level noindex for low-quality content and explains that robots.txt communicates crawl permissions. The distinction matters: a disallow can prevent a crawler from fetching a URL, while a noindex directive tells a crawler that has accessed the page not to include it in search results. Do not rely on a disallow to remove an already discovered URL from an index.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
A site might use guidance resembling the following, adjusted to its actual URL structure:
User-agent: *
Disallow: /?s=
Disallow: /search/
Disallow: /page/*/?s=
Sitemap: https://example.com/wp-sitemap.xmlReplace patterns only after confirming how your theme and plugins generate URLs. An overbroad rule can hide articles, media or feeds from legitimate crawlers. Keep security rules in the WAF or server, where an uncooperative client cannot simply ignore them.
Recommended Free Tools
6. Add WordPress-level throttling only when necessary
A plugin can be a practical fallback on hosting where you cannot configure a reverse proxy or web server. It should not be the first choice for a large attack: the request has already consumed some web-server and application resources by the time WordPress can classify or reject it.
Possible plugin approaches
- Bottle: its directory description says it can terminate WordPress processing when a throttle condition is reached. Confirm where in the request lifecycle it acts and what logging it provides.
- PSB Bot Traffic Controller: its description says it intercepts early through a must-use plugin and supports category and global rate thresholds. Verify how its categories are identified and how exceptions are configured.
These descriptions establish capabilities, not a guaranteed reduction for your site. Before activation, check the current compatibility statement, update history, PHP and WordPress requirements, support status, logging detail and uninstall behavior. Test with a staging copy or a tightly scoped production rule.
Prevent plugin false positives
Whitelist only known integrations that you can identify reliably. Test administrator login, scheduled events, REST requests, XML-RPC dependencies, contact forms, checkout or membership flows, cache purges and monitoring probes. Make sure an administrator can disable the control if it blocks the dashboard or causes a loop. If the plugin stores counters in the database, watch database write volume during a burst.
7. A deployment sequence you can repeat
- Inventory dependencies. List mobile apps, Jetpack, SSO, webhooks, API clients, uptime monitors, search crawlers and any service that calls WordPress automatically. Record required paths and authentication methods.
- Capture the baseline. Export bot analytics and origin logs. Record user agents, IPs, paths, rates, status codes, cache outcomes and CPU/PHP impact for a representative period.
- Protect the origin. Put a reverse-proxy WAF in front of the site when possible, or configure equivalent web-server controls. Confirm that direct-origin access is not an unfiltered bypass.
- Apply narrow rules. Start with an abusive path, a clearly excessive request rate or a verified malicious pattern. Use preview or challenge mode where available.
- Limit sensitive endpoints. Add separate controls for
/wp-login.phpand/xmlrpc.php. Disable XML-RPC only after checking dependencies; otherwise exempt the smallest legitimate flow. - Preserve verified crawlers. Use verified-bot handling, inspect crawler responses and remove broad user-agent blocks that could create crawl errors.
- Add crawl guidance. Use
robots.txtfor cooperative low-value URL control and page-levelnoindexwhere indexing, rather than fetching, is the problem. - Use a plugin only if needed. Select a maintained, compatible controller, test it, and ensure an emergency bypass exists.
- Compare the same metrics afterward. Look for changes in origin requests, uncached fetches, PHP workers, CPU, 4xx/5xx responses, login success and crawler access. Keep the rule if it solves the measured problem without unacceptable collateral damage; otherwise narrow or roll it back.
8. Troubleshoot the common failure modes
| Symptom | Likely cause | What to check or change |
|---|---|---|
| Origin CPU remains high after blocking a bot | Traffic bypasses the proxy, or the rule matches only one user-agent | Verify DNS and origin firewalling; inspect IPs, paths and rates rather than relying on the header alone |
| Editors or customers see 429 or challenge pages | Shared IPs, an overly low threshold or a rule applied site-wide | Raise or scope the threshold, use authenticated exceptions and separate login from public traffic |
| Search impressions or indexed pages fall | A broad anti-bot rule blocks verified crawlers | Review crawler events and 403/429 responses; use verified-bot exceptions and remove broad “bot” matches |
| Mobile publishing or an integration stops working | XML-RPC or API traffic was blocked without an exception | Identify the exact dependency, authenticate it where possible and exempt only its required path or source |
| Robots.txt changes have no effect on abusive traffic | The client ignores cooperative directives | Move enforcement to the WAF or web server; retain robots.txt only for compliant crawlers |
| A plugin blocks the dashboard or causes slow requests | Application-level interception, incompatibility or counter writes consume resources | Use the plugin’s emergency disable method, inspect logs, update or remove it, and move the control to the edge when possible |
| Legitimate requests are cached incorrectly | Rate-limit or challenge rules ignore cache and authentication state | Review cache status, cookies, authorization headers and API behavior before expanding the rule |
9. Operate the controls over time
Bot behavior changes. Revisit analytics after major launches, URL-structure changes, plugin additions and search-crawler warnings. Keep an inventory of every exception and its owner; an undocumented exception tends to become a permanent bypass.
- Review top paths and request-rate distributions on a recurring schedule.
- Alert on sudden increases in 401, 403, 429 or 5xx responses, PHP worker saturation and uncached origin fetches.
- Test login, XML-RPC-dependent integrations, APIs, sitemaps and important pages after WAF or server changes.
- Retire rules that no longer match traffic, and reduce broad allowlists to specific paths or verified identities.
- Keep a rollback copy of the previous WAF, server and plugin configuration.
Do not judge success by a single blocked-request count. The meaningful question is whether abusive work stopped reaching the origin while legitimate users, integrations and crawlers continued to receive the responses they need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
