Stop abusive WordPress requests before they execute PHP. The reliable sequence is to inventory the dynamic paths receiving traffic, put path- and method-aware rules at an edge WAF or CDN, separate authenticated API traffic from anonymous traffic, make an explicit XML-RPC decision, and then add origin-layer throttling as a second line of defense.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Caching ordinary pages does not protect wp-login.php, xmlrpc.php, REST API routes, search requests, form handlers, or plugin AJAX actions. Those requests can still start WordPress, consume PHP workers, and query MySQL. The controls below are designed to reduce that work without breaking monitoring, deployments, Jetpack, partner APIs, or other legitimate automation.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why cached pages do not stop dynamic bot traffic
Page caching and endpoint execution are different paths
A page cache can serve a previously generated HTML response without running WordPress for a cacheable request. A bot that submits a login, sends an XML-RPC call, posts to a form, or requests an uncached API route is asking for a dynamic response instead. The request reaches the web server, loads PHP, bootstraps WordPress, and may perform authentication, plugin work, and database queries before a response is produced.
Even a GET request can be dynamic. A cache miss, a private response, an authorization header, a query string, or a route that sends Cache-Control: no-cache can force origin processing. A high volume of failed requests can therefore exhaust PHP workers or database connections while the site’s public home page continues to load from cache.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
The paths bots commonly target
/wp-login.phpfor credential stuffing, password-reset abuse, and repeated login attempts./xmlrpc.phpfor method calls, pingbacks, and integrations that require XML-RPC./wp-json/and individual REST routes for discovery, content enumeration, and write operations.- Search and query endpoints, including expensive requests with many parameters.
- Form handlers and plugin-specific AJAX routes, often under
/wp-admin/admin-ajax.phpor a plugin-defined path.
The right response is not a single domain-wide block. It is a set of controls matched to the endpoint’s method, authentication state, expected clients, and backend cost.
Inventory the dynamic surface before changing limits
Start with access logs, CDN analytics, and WordPress knowledge. Record enough detail to distinguish a noisy endpoint from a legitimate burst and to see whether a rule is actually reducing origin work.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Endpoint class | Methods to inspect | Authentication questions | Record for each request |
|---|---|---|---|
/wp-login.php |
GET, especially POST |
Is the request anonymous, or does it carry a valid login cookie? | Source, method, status, response time, and failed-login pattern |
/xmlrpc.php |
Usually POST |
Does Jetpack or another known integration need it? | Caller identity, method volume, status, and whether calls are accepted |
/wp-json/ and REST routes |
GET, POST, PUT, DELETE where enabled |
Which routes are public and which require a logged-in user or an authorization header? | Route, method, auth state, status, and backend time |
| Search and query routes | Usually GET |
Are anonymous searches allowed, and which parameters are costly? | Query shape, cache status, status code, and database time if available |
| Forms and plugin AJAX | Often POST, sometimes GET |
Does the action require a nonce, account, or partner identity? | Action name, caller, status, and side effects |
The REST API is particularly easy to discover. In a standard WordPress installation, a GET request to /wp-json/ returns the REST API index, which exposes route information. Public and authenticated resources can coexist, so blocking the entire prefix can break mobile clients, editorial tools, integrations, or other features. Inventory the individual routes that matter instead of assuming every REST request has the same risk.
Establish a baseline
Measure a normal period that includes business hours, publishing activity, backups, monitoring, and scheduled jobs. For every dynamic path, note the usual request rate, peak bursts, proportion of 2xx/3xx/4xx/5xx responses, and approximate PHP or database cost. A threshold is useful only when it is tied to this baseline and the endpoint’s behavior.
Put the first control at the edge
WordPress guidance recommends an edge or WAF layer so abusive traffic is rejected before it reaches the origin. A CDN/WAF can inspect the request path, method, headers, cookies, source characteristics, and response behavior without spending an origin PHP worker on every attempt.
Create endpoint-specific rules
In the WAF’s rate-limiting area, create separate rules for the paths you inventoried. A rule should state:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
- Which requests match: hostname, normalized path, HTTP method, and any required header or cookie condition.
- What is counted: commonly a source address, authenticated identity, session characteristic, or a combination supported by the provider.
- What happens at the limit: allow, throttle, challenge, or block.
- How long the action lasts and which response status the client receives.
Use path and method together. A read-only public GET route normally needs a different policy from a state-changing POST. For example, an illustrative expression pattern might look like (path equals "/wp-login.php" AND method equals "POST"). Adapt the syntax to your provider; the important part is the condition, not the punctuation.
| Traffic pattern | Typical edge treatment | Reason |
|---|---|---|
Anonymous POST to /wp-login.php |
Strict throttle, challenge, or temporary block after repeated failures | Login attempts are expensive and rarely need a high anonymous rate. |
| Authenticated REST requests | Separate, higher allowance keyed to the authenticated client | Editorial and application clients may legitimately make bursts. |
Anonymous REST GET |
Moderate limit, with route-specific exceptions for public consumers | Public reads can be valid, but enumeration can still consume origin resources. |
REST writes such as POST, PUT, or DELETE |
Stricter limit and authentication/header checks | Writes have greater side effects and usually cost more to validate. |
POST to /xmlrpc.php |
Disable when unused; otherwise allow known integrations and throttle the remainder | XML-RPC is a high-value target and has a clear integration dependency. |
| Repeated 403/404 requests | Short-lived challenge or block based on response code and path pattern | Scanning bots often reveal themselves through large volumes of denied or missing URLs. |
Separate anonymous and authenticated traffic
Do not put logged-in editors, an application using an authorization header, and unauthenticated scanners in one counter. Use a trustworthy authentication signal, such as a valid WordPress login cookie or an authorization header validated by the application. Do not treat an arbitrary query parameter as proof of identity.
For public APIs, an IP-only counter can punish users behind a shared network. For authenticated APIs, a per-client or per-user counter can protect one account without penalizing every visitor. If your provider supports multiple counting characteristics, combine them carefully and test the result with real clients.
Choose the least disruptive action
- Allow: use for explicitly verified or essential clients.
- Throttle: slow a burst while preserving a chance to complete legitimate work.
- Challenge: useful for browser traffic, but often incompatible with scripts and APIs.
- Block: reserve for clearly abusive traffic or an endpoint that should not be reachable.
Make the resulting status observable. A throttled client may receive a rate-limit response such as 429; a denied request may receive 403. Document the behavior for integration owners so they can distinguish a security action from an application failure.
Recommended Free Tools
Normalize the URL before matching
Attackers may vary casing, percent-encoding, duplicate separators, dot segments, or query formatting to evade a naïve string match. Apply the WAF’s URL normalization before evaluating the path, and test alternate encodings against the same rule. Also inspect the origin’s routing behavior: two visibly different URLs can resolve to the same WordPress endpoint.
Use bot controls, but create exceptions first
Bot detection and challenge products can reduce automated abuse, but broad controls can also interfere with legitimate automation. Before enabling a domain-wide bot action, list every known non-browser client:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
- Uptime and transaction monitoring.
- CI/CD jobs that publish, purge caches, or run health checks.
- Partner APIs and mobile or desktop applications.
- Backups, feeds, analytics collectors, and internal administration tools.
Create skip or allow rules for those clients before the broad bot rule. Prefer stable, verifiable signals such as documented source addresses, a dedicated hostname, an authenticated header, or a provider’s verified-bot mechanism. Keep exceptions as narrow as possible: an integration that needs REST reads should not automatically bypass login or XML-RPC protections.
Understand domain-wide bot modes
A domain-wide mode can apply the same action to every path. Cloudflare’s Super Bot Fight Mode, for example, is domain-wide; path-specific bot thresholds require more advanced Bot Management controls. A blanket setting may challenge a monitoring probe or a CI/CD request even when those clients are known and desirable. If you cannot express the required path and client exceptions, start with endpoint-specific rate rules instead of turning on the broadest action.
Make an explicit XML-RPC decision
If nothing needs XML-RPC, disable it
When Jetpack and every other integration are absent, disabling XML-RPC removes an exposed dynamic endpoint. Use the disable control provided by your host, WAF, web server, or WordPress security configuration, then verify from an external network that requests no longer reach an active handler. Check logs after the change; a stream of attempts is expected, but they should no longer consume application work.
If an integration needs it, preserve only the required traffic
Jetpack and other clients can depend on XML-RPC. In that case, do not apply a blanket block. Cloudflare documents a WP0007 protection pattern for Jetpack traffic; use the equivalent integration-specific exception in your WAF, then rate-limit and monitor other XML-RPC requests. Match the documented client pattern as narrowly as possible and review it when the integration changes.
Use a blanket block only as an emergency measure
A rule that blocks all XML-RPC stops both abuse and legitimate calls. Treat it as an emergency containment action while you identify dependencies, not as the default configuration. Record which integration failed, restore the minimum required exception, and retain rate limiting for the remaining traffic.
Add origin-layer defense in depth
Edge filtering should carry the main load, but the origin still needs safeguards for traffic that passes an exception or arrives through an alternate route.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Login throttling: slow repeated failures and apply temporary abusive-IP bans without locking every user behind a shared network.
- CAPTCHA or Turnstile at the right point: use it for suspicious browser actions, not as a blind replacement for API authentication.
- Web-server restrictions: deny clearly unwanted methods or paths before WordPress initializes, where your server configuration supports that safely.
- WordPress firewall controls: enforce application-aware limits for login, XML-RPC, and plugin actions that the edge cannot identify.
- Monitoring and updates: keep WordPress, themes, and plugins current, and alert on unusual endpoint volume, error rates, PHP saturation, and database pressure.
Do not rely on an origin plugin alone when the server is already overloaded: a plugin rule still requires enough PHP and database capacity to run. The edge layer reduces volume first; the origin layer handles residual traffic and application-specific decisions.
Calibrate limits from evidence, not a universal number
There is no site-independent requests-per-minute value that is safe for every WordPress installation. Published configuration examples demonstrate how to build a rule, not a universal threshold. A small site with an expensive search query may need a lower limit than a large site with a heavily used public API.
A practical calibration method
- Measure the normal rate for each endpoint and authentication class, including legitimate peaks.
- Estimate the cost of one request: PHP execution time, database queries, external calls, and whether the response is cacheable.
- Set an initial limit above the observed legitimate peak, with a short action period so mistakes are reversible.
- Observe WAF events, origin logs, 2xx/4xx/5xx responses, PHP worker use, and database load.
- Lower the limit or strengthen the action only when the evidence shows abuse; raise it when verified clients are being delayed.
Use different counters for different jobs. A login rule can count failed attempts, while a REST rule counts requests by authentication state. A response-code rule can target clients generating large numbers of 403 or 404 responses. Keep the counting window and action duration short enough to avoid turning a temporary burst into a long outage.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Implementation sequence you can follow
- Export the traffic: gather CDN and origin logs for the same period, retaining path, method, source, status, authentication indicator, and timing.
- Classify endpoints: label login, XML-RPC, REST reads, REST writes, searches, forms, and plugin AJAX actions.
- Mark dependencies: identify monitoring, deployment, partner, Jetpack, and internal clients that must continue to work.
- Deploy exceptions: add narrow allow or skip rules for those clients before broad bot controls.
- Create edge rules: match normalized path and method, separate authenticated and anonymous traffic, and choose throttle, challenge, or block per endpoint.
- Decide XML-RPC: disable it when unused; otherwise preserve the required integration and rate-limit the rest.
- Add origin controls: enable login throttling, temporary bans, application firewalls, and suspicious-request challenges.
- Test safely: exercise a real login, public REST read, authenticated REST call, required integration, and a deliberately over-limit request from a test client.
- Review after deployment: compare origin CPU, PHP workers, database activity, endpoint volume, status codes, and false-positive reports with the baseline.
Troubleshoot the common failure modes
Bot traffic still reaches the origin
Confirm DNS and proxying place the hostname behind the WAF, and check that the rule matches the normalized path and correct method. Inspect alternate hostnames, direct-origin addresses, IPv6 records, and URL encodings. A rule on GET will not stop a POST to the same endpoint.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A legitimate API client receives challenges or blocks
Find the client in WAF events, then add a narrow exception based on a stable identity. If the client cannot complete a browser challenge, use authentication and rate limiting instead. Do not bypass every security rule for an integration that needs only one REST route.
Users behind one network are throttled
An IP-only counter can group offices, schools, mobile carriers, or VPN users together. Separate authenticated users from anonymous traffic and use a client or session characteristic where the provider supports it. Keep anonymous limits high enough for expected shared-network bursts, then watch for abuse.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Blocking REST breaks a site feature
Inspect the failing route and method rather than reopening the entire /wp-json/ prefix. Public and authenticated routes may coexist, and a write route often needs a different policy from a read route. Add the minimum route-specific exception and test its authentication requirement.
XML-RPC blocking breaks publishing or synchronization
Identify which integration uses the endpoint. Replace the blanket block with the documented integration exception and a rate limit for all other callers. If no integration remains, keep XML-RPC disabled and remove obsolete exceptions.
CPU or MySQL usage remains high after a page-cache change
Compare endpoint logs, not just page-cache hit rate. Dynamic login, REST, search, form, and AJAX requests may be bypassing the cache by design. Move their controls to the edge, then examine whether a plugin route or query variant is generating cache misses and expensive database work.
Attackers evade a simple path rule
Review normalized URLs, duplicate separators, encoded characters, query strings, alternate hostnames, and method changes. Add response-code and behavior-based rules for repeated 403/404 scanning, and test every variation against the rule before declaring it effective.
What success looks like
A successful rollout is measurable. The edge should show abusive requests being throttled, challenged, or blocked; the origin should process fewer dynamic requests; PHP worker saturation and database pressure should fall; and known clients should retain their expected success rate. Continue reviewing firewall events and access logs after each change. Re-baseline when you add a new integration, launch a mobile client, change a plugin, or alter publishing workflows.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
