WordPress Bot Attacks

Bot attacks on WordPress sites have three aims: guessing the administrator password (brute force), copying content, and sending spam through forms or comments. The most effective defence is to stop bots layer by layer before they reach WordPress.

1. Cloudflare (first line of defence)

• Bot Fight Mode: Included in the free plan; automatically blocks known malicious bots.
• WAF rules: If your visitors come only from certain countries, you can challenge wp-login.php requests from other countries.
• Challenge: Suspicious visitors are shown a short verification page; most bots cannot pass it.

To use Cloudflare you need to point your domain's name servers to Cloudflare: How do I change my name servers?

2. Server-side protection

webevi hosting servers run ModSecurity (web application firewall) and Fail2Ban. Fail2Ban blocks IP addresses with repeated failed logins in the server firewall, so bot requests never even reach PHP. On your own VDS you can manage these settings in Plesk under Tools & Settings > IP Address Banning (Fail2Ban).

3. WordPress-side protection

• Login page: Most bots target wp-login.php. Limit login attempts, turn on 2FA and, if you like, change the login URL.
• XML-RPC: Bots use this file to try many passwords in a single request. Turn it off if you do not use it: .htaccess tips for WordPress sites
• Honeypot: A hidden field that visitors cannot see is added to forms; whoever fills it in is a bot. Antispam Bee or your form plugin's own honeypot option filters out bots without a captcha.
• Rate limiting: If you use Wordfence, its Rate Limiting settings automatically block crawlers that send too many requests.

Blocking crawler bots that overload your site

If aggressive crawlers such as SEO tool bots slow your site down, you can block them with .htaccess. Do not block search engine bots such as Google or Bing; your site would drop out of search results.

# Block crawler bots that overload the site (example)
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (AhrefsBot|SemrushBot|MJ12bot|DotBot) [NC]
RewriteRule .* - [F,L]

How can you tell you are under attack?

The site suddenly slowed down or shows a 503 error

This may be heavy bot traffic. Check the Logs section in Plesk for a large number of requests to wp-login.php or xmlrpc.php.

You get a lot of spam through forms

Add a honeypot or reCAPTCHA to your form.

You cannot log in to your administrator account

Reset your password and open a support ticket; we will check your site for malware together.

General measures: Security tips for WordPress sites