Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Use several controls together: stop suspicious requests at a managed edge WAF/CDN, throttle expensive endpoints at the web server, harden WordPress accounts and XML-RPC, patch every layer, and automatically quarantine repeated failures. This reduces the traffic that reaches your VPS without blocking legitimate administrators, APIs, scheduled jobs, or verified crawlers. Maintain tested backups so a successful compromise or destructive request is recoverable.
What a bot attack is—and why WordPress sites are targeted
A bot attack is automated traffic that repeatedly requests pages, submits credentials, probes for vulnerable plugins, abuses APIs, or consumes server resources. Some automation is useful: search crawlers, uptime monitors, payment callbacks, and services such as Jetpack may need access. The goal is therefore not to block every bot. It is to distinguish expected automation from abusive behavior and stop the latter as far from the origin as possible.
WordPress installations are attractive because common paths and login endpoints are easy to discover. A compromised account can also become a bridge into the VPS: an attacker may upload a web shell, alter plugins, add administrator users, steal database credentials, or use the server to attack others. A layered design limits both the initial requests and the damage after a password or plugin is compromised.
Use four defensive layers
| Layer | Acts at | Useful signals | What it protects | Main trade-off |
|---|---|---|---|---|
| Edge WAF/CDN | Before the VPS | IP reputation, bot score, request behavior, managed signatures | Bandwidth, origin CPU, PHP workers and database connections | Rules can challenge legitimate users or crawlers if they are too broad |
| Web server | Nginx or Apache on the origin | Request rate, response codes, endpoint and client identity | Authentication paths and expensive unauthenticated requests that reach the VPS | Misconfigured limits can disrupt APIs, cron jobs or administrator work |
| WordPress | Application and account layer | Failed logins, privilege changes, plugin and XML-RPC activity | Administrator accounts, content and application data | Application controls still consume some origin resources |
| VPS operations | Operating system and network | SSH authentication, web logs, process and firewall events | Server access and lateral movement after an application incident | Requires patching, log retention and a recovery procedure |
No single plugin or blocklist replaces these layers. Edge controls reduce the volume, server controls constrain what passes through, WordPress controls protect identities, and VPS controls contain an incident.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Start with a traffic baseline
Before adding aggressive rules, observe several normal days, including a publishing cycle and scheduled maintenance. Record the paths, methods, response codes and client identities associated with:
- your own administrator sessions and those of other editors;
- the WordPress REST API, webhooks and integrations;
- WP-Cron or a system scheduler;
- Jetpack or other services that call XML-RPC;
- verified search crawlers and uptime monitors; and
- large, legitimate imports, media uploads and backups.
Look for bursts rather than a single suspicious request. A normal administrator can generate several requests while editing, whereas a credential-stuffing source repeats the same login operation across many usernames or rotates addresses. Save representative log lines and response codes so you can test each new rule against real traffic.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesPut the site behind an edge WAF/CDN
Point the domain at a managed WAF/CDN and verify the complete path before enabling blocking. The proxy must be able to reach the origin, the certificate must be valid at both ends, and WordPress must still make loopback requests successfully. Keep the origin address private where practical and restrict direct access to the web ports so attackers cannot simply bypass the edge.
Safe rollout sequence
- Verify DNS and TLS. Confirm that the public hostname resolves to the edge, the edge can connect to the origin, and HTTPS redirects do not create a loop.
- Test WordPress functions. Log in, publish a draft, upload media, run a scheduled task, submit a form, and check any REST or webhook integration.
- Enable managed rules in monitoring mode. Review matches for a day or more before blocking. Exclude a rule only when a known, legitimate request is affected.
- Turn on bot analytics. Use reputation, behavioral signals and bot scores to identify likely automation. Allow verified search crawlers when their identity can be validated; do not trust a user-agent string alone.
- Challenge suspicious traffic first. A browser challenge or Turnstile-style proof can separate ordinary visitors from scripts without permanently denying an address shared by many users.
- Add narrow endpoint rules. Apply separate controls to
wp-login.php, XML-RPC and other expensive unauthenticated paths rather than creating a site-wide block.
Edge rules should produce an audit trail. Record the rule, action, timestamp, matched path and an identifier for the client. That evidence lets you tune a challenge into a block—or roll it back—without guessing.
Rate-limit the endpoints bots abuse most
There is no universal request number that is safe for every site. A small editorial site, a membership site and an API-heavy store have different legitimate patterns. Set a window and threshold above the normal administrator, integration and crawler behavior observed in your baseline, then lower it gradually while watching false positives.
| Endpoint or signal | Why it matters | Control to apply | How to tune it |
|---|---|---|---|
/wp-login.php |
Credential stuffing and password guessing | Count failed responses by account and client; challenge or delay repeated failures | Permit normal administrator bursts, but make repeated failures increasingly expensive |
/xmlrpc.php |
Pingbacks, multicall abuse and remote login attempts | Disable when unused; otherwise restrict methods or trusted callers and rate-limit requests | Measure Jetpack, mobile-app and integration traffic before changing access |
| Repeated 403 or 404 responses | Probing for plugins, themes and hidden files | Use a short-lived challenge or temporary ban after a behavior threshold | Exclude known scanners and monitoring services; inspect paths before blocking |
| Expensive unauthenticated paths | Search, exports, uncached queries and large POST requests can consume PHP and database capacity | Cache, require authentication where appropriate, and limit request concurrency | Compare response time and worker usage before and after each rule |
Response-code-based rules are useful because a bot that guesses nonexistent paths or repeatedly receives denials is behaving differently from a visitor reading pages. Cookie-based counting can also help when one network rotates IP addresses; combine it with account, session and behavior signals rather than trusting any one identifier.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Apply limits at both the edge and the origin. The edge absorbs volume, while Nginx or Apache remains a backstop if traffic reaches the VPS directly. Make exceptions explicit for authenticated APIs, cron, trusted monitoring and verified services, and log every exception.
Protect WordPress administrator accounts
Use unique credentials and least privilege
Give every person a separate account with a strong, unique password stored in a password manager. Remove old staff accounts and the conventional legacy admin user after transferring ownership of its posts. Editors should not be administrators, and service accounts should have only the capabilities their integration requires.
Add phishing-resistant multifactor authentication
Require two-factor authentication for administrators and privileged editors. Where the identity system supports it, prefer WebAuthn or passkeys; a FIDO2 security key provides a hardware-backed option that is difficult to reuse on a fake login page. Keep a controlled recovery method, such as a second enrolled key stored securely, so an administrator is not forced to disable protection during an emergency.
Do not rely on hiding the login URL
Changing or obscuring the login address may reduce casual noise, but it is not an authentication control. Attackers can discover the endpoint through redirects, public files, links or observed traffic. Keep the real controls—unique passwords, multifactor authentication, rate limits and monitoring—in place.
Recommended Free Tools
Handle XML-RPC without breaking legitimate services
XML-RPC is an older WordPress interface used by some remote publishing tools and services. If your site does not need it, disable it at the edge or application layer and verify that publishing, mobile workflows and integrations still work. If Jetpack or another integration requires it, do not blanket-block the path:
- identify the service’s normal source behavior during the baseline period;
- allow only the methods and callers the integration needs when your stack supports that distinction;
- rate-limit repeated requests and failed authentication attempts;
- challenge anomalous clients instead of blocking every XML-RPC request; and
- review logs after each change for failed syncs, delayed publishing or unexpected multicall activity.
A 403 response from an XML-RPC rule is not proof that the control is correct; it may simply mean that a required integration was caught. Test the complete workflow after deployment.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Harden Nginx or Apache on the VPS
Origin limits should be independent of the edge. Configure the web server to limit request rate and concurrent work on authentication and expensive paths, while leaving enough capacity for legitimate administrators and APIs. Use separate policies for anonymous traffic and authenticated or internal jobs; a single global limit is likely to break something important.
Keep the server’s public surface small. Expose only the ports required for HTTPS, administration and explicitly supported services. Administer over encrypted SSH or SFTP, prefer key-based authentication, restrict administrative access by network where feasible, and do not expose database ports to the internet. Store web, authentication and firewall logs centrally or on protected storage so an attacker cannot erase every trace.
The WordPress hosting guidance recommends throttling both the maximum logins per site over time and the maximum attempts per IP over time across the server or infrastructure. Implement both dimensions: an attacker may rotate addresses, while one compromised account may be targeted from many sources.
Use Fail2ban for temporary, evidence-based bans
Fail2ban or an equivalent can watch web and SSH logs, match repeated failures, and add a temporary firewall ban. It is most effective as a response layer, not as the first line of defense. The edge should absorb broad traffic; Fail2ban should quarantine clients that have demonstrated a pattern.
Build a safe jail
- Choose the correct log files for your distribution and web server, and confirm that failed authentication is actually recorded.
- Write a filter that matches a narrow event, such as repeated failed WordPress logins or SSH authentication failures. Test it against real log lines and ensure successful logins do not match.
- Set a find window and retry threshold based on your baseline. Use a temporary ban so a false positive expires without manual intervention.
- Add an allowlist for your emergency administration network, trusted monitoring and verified services. Review it regularly; an old allowlist is an access-control risk.
- Watch ban events, CPU use and legitimate login reports. Adjust the filter or threshold before increasing ban duration.
- Document the unban procedure and keep console access available in case an administrator is locked out.
Permanent IP or country blocklists are brittle: addresses change, mobile users share networks, and attackers use cloud providers around the world. Temporary bans tied to observed behavior are easier to reverse and less likely to create long-lived false positives.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Patch every component
Keep WordPress core, themes, plugins, the operating system, PHP runtime and web server current. Remove abandoned themes and plugins instead of leaving unused code enabled. Subscribe to security advisories for the components you operate and schedule updates so they are not postponed indefinitely.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before a major update, confirm that a current backup exists and that you can access the server console. After updating, test the front end, administrator login, publishing, media uploads, REST endpoints, scheduled tasks and payment or webhook integrations. A patched application still needs monitoring: stolen credentials and newly disclosed vulnerabilities can be exploited before a rule or update is available.
Monitor for compromise and abnormal automation
Centralize and retain enough data to answer who did what and when. At minimum, monitor:
- failed and successful administrator logins, including unusual locations or times;
- new users, role changes, password resets and changes to authentication settings;
- plugin, theme and core file changes;
- spikes in 403, 404, 429 and 5xx responses;
- unexpected XML-RPC, REST or upload activity;
- new processes, outbound connections, scheduled jobs and sudden CPU, memory or disk usage; and
- Fail2ban bans, firewall changes and attempts to access SSH.
Alert on combinations, not isolated events. A single failed login is ordinary; hundreds followed by a successful login and a new administrator account is an incident. Preserve relevant logs before deleting a compromised account or reinstalling a plugin.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Backups and recovery are part of bot defense
Maintain automated backups of the database, uploaded media, configuration and any custom code. Keep copies outside the VPS, protect them from deletion by the web account, and retain versions far enough back to predate a slow compromise. Encryption is important, but so is a tested restore.
On a schedule, restore to an isolated environment and verify that the site opens, administrators can authenticate, media exists and scheduled jobs work. Record who can disable WAF rules, access the console, rotate credentials and restore a clean copy. If a bot succeeds, isolate the server, preserve evidence, rotate WordPress, database, SSH and API credentials, patch the entry point, and restore only after identifying how persistence was removed.
Operational runbook
- Baseline traffic for several days. Map normal administrator, API, cron, Jetpack, crawler and monitoring behavior.
- Deploy the edge WAF/CDN. Verify DNS, TLS, origin reachability, loopback requests and all critical workflows.
- Enable managed rules and analytics. Begin with monitoring and challenges; allow verified services deliberately.
- Rate-limit narrowly. Start with
wp-login.php, XML-RPC and expensive anonymous paths. Log matches and review false positives. - Harden identities. Remove legacy administrators, enforce least privilege, require multifactor authentication and enroll recovery credentials.
- Patch the stack. Update WordPress, extensions, PHP, the operating system and the web server; remove unsupported components.
- Connect logs to temporary bans. Deploy Fail2ban or an equivalent, maintain an allowlist process and document emergency access.
- Test restoration. Practice backup recovery and record the people and credentials required to regain control.
Choosing the right control for a symptom
| Symptom | First control | Additional control | Avoid |
|---|---|---|---|
| Login requests consume PHP workers | Edge login rule and challenge | Origin rate limit plus account/IP failure tracking | Only changing the login URL |
| Many rotating addresses probe files | Behavior-based edge challenge using paths and response codes | Temporary bans and removal of vulnerable components | A permanent country blocklist |
| XML-RPC traffic breaks Jetpack | Measure legitimate callers before blocking | Method or caller restrictions and a separate rate limit | Disabling XML-RPC without testing publishing and sync |
| SSH failures spike | Firewall restriction and key-based administration | Fail2ban, centralized logs and console recovery | Leaving password SSH open to the entire internet |
| CPU remains high after edge rules | Inspect origin logs and expensive paths | Web-server concurrency limits, caching and application review | Assuming every high-CPU event is a bot |
Troubleshooting false positives and lockouts
Legitimate administrators are challenged repeatedly
Check whether the rule counts requests by shared office IP, whether a proxy is hiding individual clients, and whether the threshold is lower than the normal editing burst. Use an authenticated or verified exception with the smallest possible scope, then retest from an untrusted network.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Search traffic falls after enabling the WAF
Inspect challenged requests and validate crawler identity rather than trusting a user-agent value. Permit verified crawlers only for the paths they need. Do not disable all bot controls because one rule was too broad.
A cron job or API receives 429 or challenge responses
Identify the exact user agent, credentials and path used by the job. Give that integration an explicit, narrow policy and keep authentication and request-size limits in place. Re-run the job while watching origin logs.
An administrator is locked out
Use the documented console or recovery account, temporarily disable the specific rule, restore access, and inspect the match that caused the lockout. Do not remove every security layer as a permanent fix; correct the scope, threshold or allowlist entry and record the change.
The VPS is still slow
Compare edge request volume with origin access logs. If origin traffic is low, profile PHP workers, database queries, disk I/O and scheduled jobs; the cause may be a plugin, a legitimate traffic surge or a compromise rather than an ongoing bot flood.
How the options compare
| Option | Where it acts | Detection | Origin-resource effect | False-positive tools | Operational cost | Recovery |
|---|---|---|---|---|---|---|
| Managed WAF/CDN | Edge | Reputation, bot score, signatures and behavior | Can block before PHP and the database are reached | Challenges, verified-bot handling and allowlists | Plan limits, rule maintenance and log storage | Versioned rules and a documented bypass or rollback |
| Web-server limits | Origin web server | Rate, path, concurrency and response codes | Stops work before application processing, but after the request reaches the VPS | Per-path policies and trusted exceptions | Configuration testing and server administration | Console access and reversible configuration |
| WordPress controls | Application and accounts | Authentication failures, roles, XML-RPC and plugin behavior | Consumes some application resources before rejecting a request | Role-based access, 2FA and integration-specific settings | Updates, compatibility testing and alert review | Recovery accounts and clean backups |
| Fail2ban or equivalent | VPS firewall | Log patterns and repeated failures | Blocks subsequent connections after evidence accumulates | Temporary bans and allowlists | Filter tuning, log retention and incident response | Unban procedure and out-of-band console access |
What success looks like
A protected site still receives probes; success means they consume little origin capacity, privileged accounts resist takeover, and an anomaly produces an actionable alert. Review dashboards and logs after rule changes, during traffic spikes and whenever WordPress or an integration is updated. Keep the controls narrow enough to preserve real users and strong enough that repeated failures become progressively harder, while backups and a rehearsed recovery plan make the remaining risk survivable.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
