: Wordpress security from bots One of my clients website is getting massive traffic from China most of which are bots. These bots are hitting the site nonstop causing the VM to use very high

@Heady270

Block IP Addresses

If you find that certain IP addresses are hitting your site over and over, you can block them individually in .htaccess

Order Deny,Allow
Deny from 1.1.1.1
Deny from 2.2.2.2
Deny from 3.3.3.3


Too many rules are required to block entire regions of the world by IP address in .htaccess. For example blocking the US would require 150,000 lines of text. (Source)

Block User Agents

If the bots are not spoofing major browsers, you can block them by user agent:

# Bot Blocker
<IfModule mod_setenvif.c>
SetEnvIfNoCase User-Agent ^$ keep_out
SetEnvIfNoCase User-Agent (pycurl|casper|cmsworldmap|diavol|dotbot) keep_out
SetEnvIfNoCase User-Agent (flicky|ia_archiver|jakarta|kmccrew) keep_out
SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|planetwork) keep_out
<Limit GET POST PUT>
Order Allow,Deny
Allow from all
Deny from env=keep_out
</Limit>
</IfModule>


(Source)

Other techniques

This article has a number of other techniques that you can use. The article explains each one very well, so it would be better to read the details about each one there.


Find hosting that does the blocking
Use a CDN
Install Apache modules such as MaxMind
Implement blocking in your application (such as PHP)
Use routing tables
Use ModSecurity on the webserver
Use a proxy service such as CloudFlare

Vote Up Vote Down