Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Put your WordPress site behind Cloudflare, preserve verified bots first, then apply the least aggressive control that solves the abuse: block traffic Cloudflare identifies as definitely automated, challenge likely automated requests, and add separate WAF rules or rate limits for abused paths such as /wp-login.php, /xmlrpc.php, and /api/. Begin in observation mode with Bot Analytics and increase thresholds only after checking false positives.
This layered approach matters because “bad bots” are not one category. Scrapers, vulnerability scanners, credential-stuffing tools and API clients can look different from Googlebot, Bingbot, uptime monitors or WordPress loopback requests. Cloudflare’s verified-bot exceptions, bot scores, built-in bot controls, custom WAF rules and rate limiting let you separate those cases instead of blocking every automated request.
What the Cloudflare setup should accomplish
A useful policy has four outcomes:
- Verified crawlers and monitoring services continue to reach public pages.
- WordPress loopback requests used by publishing, scheduled tasks and health checks are not broken.
- Clearly scripted traffic is blocked, while uncertain traffic receives a challenge rather than an immediate denial.
- High-volume or sensitive endpoints have stricter, path-specific controls than ordinary page views.
Cloudflare describes a low bot score as an indication that a request comes from “a script, API service, or an automated agent.” Treat that score as a signal, not as proof that every request is malicious. A scanner and a legitimate API client can both be automated, so the action should reflect the endpoint, authentication model and tolerance for challenges.
Prerequisites and a safe starting point
Route the WordPress hostname through Cloudflare
The site must be proxied by Cloudflare for its HTTP traffic. Confirm that the WordPress hostname serving the affected pages is orange-cloud proxied in the DNS area and that visitors are reaching Cloudflare before you create rules. If a hostname remains DNS-only, its requests will not pass through the bot and WAF controls described here.
#1 Best Overall
Record the traffic you cannot afford to break
Make a short inventory before changing anything:
- Search crawlers you rely on, including Googlebot and Bingbot.
- Uptime monitors, deployment hooks and external integrations.
- WordPress publishing, scheduled-task and site-health functions.
- Public or authenticated API consumers, mobile apps and webhooks.
- Administrative paths used by your team, including any custom login URL.
Keep a test account and a way to inspect Cloudflare security events. A rollback is easiest when you know which hostnames, paths and integrations should generate normal requests.
Start with Bot Analytics
Open Cloudflare’s Bot Analytics and inspect the distribution of automated traffic, paths, countries, methods and actions. Cloudflare recommends starting with a small threshold and increasing it over time. Establish a baseline during both a quiet period and a normal publishing period; a rule that looks harmless overnight may challenge a legitimate editor or integration during a release.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse the smallest change that answers the question you are investigating. If a sudden spike is concentrated on /wp-login.php, protect that path instead of immediately blocking every low-score request on the site. If the same source is probing many unrelated paths, a broader bot action may be justified.
Preserve verified bots and WordPress loopbacks first
Create the verified-bot exception before broad rules
Put an exception ahead of any general bot block or challenge. Cloudflare’s documented expression is (cf.bot_management.verified_bot); use a WAF custom rule with a Skip action for the controls you would otherwise apply. Verified bots include examples such as Googlebot, Bingbot and monitoring services. This is safer than trusting a user-agent string, which an attacker can copy.
In the dashboard, create the skip rule before enabling broad “definitely automated” or score-based actions. Scope the skip only to the controls that need bypassing. A blanket bypass of every security feature can remove protections that have nothing to do with bot detection, so review the Skip action’s selected products and phases.
Enable Optimize for WordPress when your plan provides it
Optimize for WordPress is intended to allow WordPress loopback requests through bot protection. Loopbacks are requests the site makes to itself and can be involved in publishing, scheduled tasks and health checks. Enable the setting where it is available, then verify that those functions complete normally rather than assuming the toggle solved every integration.
After the exception is active, test a real Google search preview or indexing workflow, an uptime check and a WordPress Site Health check. A request that is not recognized as verified may still be challenged, so use Security Events and Bot Analytics to identify the exact request and adjust only the narrowest rule necessary.
Know which Cloudflare bot controls your plan includes
Cloudflare’s feature availability differs by plan. The following is the capability split documented for the controls relevant to WordPress:
| Capability | Availability stated by Cloudflare | What it is useful for |
|---|---|---|
| Block AI bots | All plans | Blocks traffic identified as AI bots through the built-in control. |
| JavaScript detections | All plans; automatic on Free | Adds an automated browser signal that can inform bot decisions. |
| Definitely automated | Pro, Business and Enterprise through Super Bot Fight Mode | Blocks or acts on traffic Cloudflare classifies as definitely automated. |
| Likely automated | Pro, Business and Enterprise through Super Bot Fight Mode | Challenges or otherwise handles less-certain automation. |
| Verified bots | Pro, Business and Enterprise through Super Bot Fight Mode | Preserves recognized crawlers and services. |
| Static resource protection | Pro, Business and Enterprise through Super Bot Fight Mode | Applies bot controls to requests for static resources. |
| Optimize for WordPress | Pro, Business and Enterprise in the documented feature table | Allows WordPress loopback requests through bot protection. |
| Bot Management | Enterprise paid add-on | Provides 1–99 scores, analytics and granular actions through WAF custom rules or Workers. |
If a setting is absent from your account, do not reproduce its behavior with a guessed rule. Use the controls exposed on your plan—such as JavaScript detections, custom WAF rules or rate limiting—and document the resulting trade-off.
Use bot scores for graduated decisions
Interpret the documented score ranges
Cloudflare Bot Management scores requests from 1 through 99. A score of 1 is the definitely automated category in Cloudflare’s baseline example. Scores from 2 through 29 are treated as likely automated in that example. Higher scores indicate less automation according to the model, but the score is not a statement about a person’s intent or the safety of an authenticated request.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCloudflare’s documented starting policy blocks score 1 and applies Managed Challenge to scores 2–29. Implement that as a baseline only after you have inspected Bot Analytics. A site whose visitors include command-line clients, privacy-focused browsers, or legitimate automation may need a narrower path condition or a challenge instead of a block.
Example custom-rule logic
In WAF custom rules, express the actions in separate rules so each can be reviewed and reordered:
- Create the verified-bot Skip rule first.
- Create a block rule for requests whose bot score equals 1, optionally restricted to the paths or methods receiving abuse.
- Create a Managed Challenge rule for scores from 2 through 29.
- Log and review the resulting events before expanding the rule to additional hostnames or paths.
The exact expression-field names shown in the editor depend on the Cloudflare product and plan. Select the bot-management score field offered by your account rather than pasting an expression intended for a different product tier.
Understand rule order and Skip behavior
Rule order is part of the policy. When a rule blocks or challenges a request, later phases do not evaluate that request. A Skip action can bypass selected later controls, including rate limiting, Super Bot Fight Mode and managed rules. Therefore, place the verified-bot exception before broad actions, and review every product selected in the Skip rule. An overly broad skip can let a request avoid protections you intended to retain.
Protect WordPress paths with custom WAF rules
Use path-specific rules when one endpoint has a different risk profile from the rest of the site. Cloudflare specifically identifies custom score thresholds, combined conditions and path-specific protection as reasons to use custom rules.
/wp-login.php: slow down credential attacks
Login is a small, high-value endpoint. Combine its path with a bot signal, method or request rate so ordinary page views are unaffected. A conservative sequence is to challenge likely automation on the login path, block definitely automated requests there, and use rate limiting for repeated POST attempts. Keep an authenticated administrative test session open while deploying the rule; an unexpected challenge loop is easier to diagnose before you log out.
/xmlrpc.php: protect or disable according to site needs
XML-RPC is used by some WordPress features and integrations but is also a frequent scanning target. Do not block it solely because it exists. First identify whether your site, mobile clients or publishing tools require it. If it is unused, a path-specific block can remove a common attack surface. If it is required, challenge or rate-limit suspicious requests and preserve the verified or integration traffic you have identified.
/api/ and custom API routes
APIs often serve legitimate automation, so a blanket “no bots” rule can be destructive. Separate public read endpoints from authenticated write endpoints where possible. Apply a lower request threshold or stronger action to write operations, and use a challenge only where the client can complete it. Machine clients that cannot run a browser challenge may need an authenticated, narrowly scoped exception rather than a global bypass.
Admin and diagnostic paths
Apply stricter conditions to administrative or diagnostic paths, but avoid assuming that every request from a single IP is safe. Teams, VPNs and changing addresses make IP-only allowlists brittle. Combine the path with the bot score, method, known integration characteristic or a carefully maintained network rule.
Add rate limiting for request-volume abuse
Bot classification answers “what kind of client does this look like?” Rate limiting answers “how often is it calling this endpoint?” Use both when volume is the problem. Configure a rate-limiting rule for the relevant path and method, choose the request rate your application can tolerate, and select whether excess requests are challenged or blocked.
Start with a window and threshold that will not punish normal bursts, then compare triggered events with application logs. Login, password-reset, search and write APIs usually deserve different limits; one global number cannot represent all of them. Rate limiting is also useful when a client’s bot score is inconclusive but its request volume is clearly abusive.
Remember the evaluation interaction: a block or challenge prevents later phases from evaluating the request, while a Skip action can bypass rate limiting if that product is selected. Test the final order with a verified-bot request, an ordinary browser request and a deliberately repeated request to the protected path.
Recommended Free Tools
Roll out the policy without locking out visitors
- Observe. Use Bot Analytics and Security Events to identify scores, paths, methods, countries and known integrations.
- Preserve. Add the verified-bot Skip rule and enable Optimize for WordPress when available.
- Target. Protect the abused endpoint with a custom rule or rate limit before changing site-wide behavior.
- Challenge first. For likely automation, use Managed Challenge while you measure false positives.
- Block with evidence. Block score 1 or a clearly malicious path when logs show the action is appropriate.
- Expand gradually. Increase the threshold or scope only after normal publishing, scheduled tasks, health checks and integrations have succeeded.
- Document and monitor. Record the rule order, expressions, selected Skip products and the reason for each exception.
When testing, use a private browser window, a normal logged-in session, a mobile connection and the site’s real integrations. Confirm that a visitor can load pages and submit forms, an editor can publish, scheduled work runs, health checks pass and the API clients receive the response they expect.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
Googlebot or Bingbot is challenged
Check whether the request appears as a verified bot in Cloudflare’s event details. Confirm that the Skip rule is above the broad rule and that its expression is exactly the verified-bot condition exposed by your account. If the crawler is not recognized as verified, do not create a user-agent-only allow rule; narrow the challenged path or investigate the request characteristics instead.
WordPress publishing or scheduled tasks stop
Inspect Security Events for loopback requests and enable Optimize for WordPress if the plan includes it. Review whether a custom block, rate limit or Skip configuration is affecting the request. Test publishing and scheduled execution after every change rather than relying on a successful front-end page load.
A legitimate API client cannot connect
Determine whether the client can complete a Managed Challenge. If it cannot, use an authenticated and narrowly scoped exception, reduce the rule to the abused path or method, and add rate limiting instead of disabling bot protection site-wide. Verify the exception does not also bypass managed rules or rate limiting unless that is intentional.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Visitors report challenge loops
Look for overlapping rules, a challenge applied to static resources, or a Skip rule that is not reaching the intended phase. Temporarily narrow the path or score range, retest with a clean browser session, and then expand in small increments. Keep the original expression so you can restore it if the experiment increases false positives.
The rule has no visible effect
Confirm the hostname is proxied, the rule is enabled, the expression matches the actual request path and method, and an earlier rule is not terminating evaluation. Check that the feature is available on your plan; some bot controls and score fields require the Enterprise Bot Management add-on.
Choose the right control for the problem
| Observed problem | First control | Why | Main caution |
|---|---|---|---|
| Recognized crawler or monitor is challenged | Verified-bot Skip rule | Preserves legitimate automation before broad actions. | Keep the bypass scoped to necessary products. |
| Clearly scripted requests across many paths | Definitely automated block or score-1 block | Targets the strongest automation signal. | Check analytics for unusual legitimate clients. |
| Uncertain automation on public pages | Managed Challenge for the documented likely range | Allows a human-capable browser to continue. | Machine clients may not complete a challenge. |
| Repeated login or API requests | Path-specific rate limit | Controls volume without changing every page. | Choose thresholds separately for reads and writes. |
| WordPress self-requests fail | Optimize for WordPress and loopback review | Designed for WordPress loopback traffic. | Still verify publishing, tasks and health checks. |
Built-in settings require less maintenance and can benefit as Cloudflare updates its signatures. Custom rules provide more precision through paths, scores and combined conditions, but the site owner must maintain their expressions, exceptions and ordering. Choose the built-in control for a broad, well-understood category; choose a custom rule when the endpoint or integration has a distinct requirement.
Ongoing maintenance
Review Bot Analytics after major WordPress updates, new integrations, traffic campaigns and changes to login or API routes. Recheck the verified-bot exception when you add a monitoring service. Remove stale exceptions, especially those that bypass rate limiting or managed rules. Keep a small change log containing the date, rule action, score or path condition, observed false positives and rollback decision.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do not judge success only by the number of blocked requests. A useful result is fewer abusive requests reaching sensitive WordPress endpoints while search visibility, monitoring, publishing, scheduled work and legitimate API traffic continue to function. If the site’s normal automation changes, retune the policy rather than continually lowering the threshold.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
