Bot attacks on WordPress sites usually have three main goals: stealing login details (Brute Force), scraping content (Scraping) or sending spam comments/forms.
Especially if you use tools such as ModSecurity in "fast" mode on the server side, the most sensible approach is to block bot traffic before it reaches your site (or burdens WordPress). Here is the most effective line of defense against bots:
1. Cloudflare (First Line of Defense)
The best way to stop bots without them ever reaching your server is to use a CDN such as Cloudflare.
-
WAF (Web Application Firewall): You can block countries where bots are concentrated (for example, if you only target Turkey, other countries).
-
Bot Fight Mode: This free Cloudflare feature automatically blocks known malicious bots.
-
Challenge (JS Challenge): Shows suspicious visitors a short "verification" screen, which bots cannot get past.
2. Login Page and Brute Force Protection
90% of bots target the wp-login.php file.
-
Change the URL: As mentioned in our previous article, change the login path (
/sign-inetc.). -
Disable XML-RPC: Bots can try thousands of passwords in a single request through this file.
.htaccess– be sure to disable it with:Apache<Files xmlrpc.php> Order Deny,Allow Deny from all </Files>
3. Blocking Bots by "User Agent"
If you notice that certain bots (for example Ahrefs, Semrush or aggressive crawlers) are straining your site, you can block them at server level with .htaccess:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.*(Baiduspider|YandexBot|Sogou|AlphaBot).* [NC]
RewriteRule .* - [F,L]
4. The Honeypot Technique
Bots are programmed to fill in every field on a form. With the technique, a hidden field that users cannot see (hidden with CSS) is added to forms. If that field arrives filled in, the sender is definitely a bot.
-
Plugin Recommendation: "Stop Spammers" or "WPBruiser". These plugins silently weed out bots without asking for a captcha.
5. Dynamic Rate Limiting
If dozens of requests per second come from the same IP address, it is a bot.
-
If you use Wordfence, you can automatically block clients that send too many requests by enabling the "If a crawler's rate exceeds..." option in the "Rate Limiting" settings.
Critical Server-Level Tip
If you use Plesk or cPanel, make sure the Fail2Ban feature is enabled. Fail2Ban watches the WordPress login logs and bans the IP address of a bot that makes repeated failed logins directly in the server firewall (iptables). This way the bot's requests never even reach PHP, and your server load drops.
