What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The safest way to reduce bot-driven load is a layered sequence: measure which requests consume origin resources, filter abusive traffic at a reverse-proxy firewall, rate-limit /wp-login.php and /xmlrpc.php, preserve verified search crawlers, and use robots.txt only for cooperative crawl guidance. Add a WordPress plugin only when controls at the edge or web server are unavailable. This approach lowers unnecessary PHP and database work without blindly blocking every bot or legitimate integration.
What bot traffic is doing to your WordPress site
Every request that reaches WordPress can consume a PHP worker, query the database, read files, fill an application cache, or trigger a plugin. A crawler that repeatedly requests expensive search, filter, login, API, or XML-RPC URLs can therefore make the site slow even when the requests are not successful.
Not all bots are unwanted. Search engines, uptime monitors, accessibility tools, feed readers, mobile applications, and connected services may need to fetch pages or call an endpoint. The objective is to remove abusive or low-value origin work while allowing traffic that has a documented purpose.
No generally applicable percentage of web traffic is bot traffic, and no fixed percentage reduction in server load can be promised for every WordPress installation. The result depends on your logs, cache configuration, hosting capacity, and the rules you deploy.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
1. Measure the requests before changing a rule
Start with the CDN or web application firewall (WAF) bot-analytics view if one is present, then confirm the pattern in origin access logs. Cloudflare’s guidance begins with bot analytics for this reason: a rule based only on a vague user-agent guess can block useful traffic while leaving the expensive requests untouched.
- Record the busiest user agents. Treat the user-agent string as a clue, not proof of identity. Note spelling variants, missing user agents, and agents that change between requests.
- Group requests by path. Pay particular attention to
/wp-login.php,/xmlrpc.php, search URLs, faceted or filtered URLs, APIs, feeds, and any page that consistently causes PHP work. - Measure request rates. Capture requests per minute (and bursts), response codes, bytes returned, cache hit or miss status, and the source IP or network information available to you.
- Check origin impact. Compare PHP worker saturation, CPU, memory, database activity, queue time, and slow-request logs with the request groups above.
- Create a before window. Save the same metrics for a defined period before deploying a rule and for an equivalent period afterward. Report the observed change for your site rather than claiming a universal reduction.
Export or retain the relevant log lines. When a visitor reports that a login, API call, or page is blocked later, you need the original timestamp, path, response code, and rule decision to diagnose it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →2. Put the first filter in front of WordPress
WordPress describes a reverse-proxy firewall as an intermediary between internet traffic and the hosting server. It can accept a request, apply filtering and rate controls, and forward only allowed traffic to the origin. Because rejected requests stop before PHP and WordPress run, this is usually the most effective location for reducing application work.
Cloudflare and Sucuri are examples of services that can provide this edge layer. The exact product, plan, and features vary by region and account; select one that can send traffic to your host while preserving your real client-IP information in a trusted header.
Start with narrow edge rules
- Target a clearly abusive path, method, IP range, or request pattern instead of creating a global “block all bots” rule.
- Use rate limiting for login, XML-RPC, and API endpoints where repeated requests are the problem.
- Use your analytics to identify automation categories and test a rule in logging or monitoring mode when the service supports it.
- Keep an emergency rollback available. A single mistaken rule can affect every visitor before WordPress has a chance to respond.
Edge filtering is not a substitute for fixing an exposed origin. Restrict direct access to the origin where your hosting arrangement permits it; otherwise an attacker can bypass the proxy and send the same load straight to the server.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
How the main control points compare
| Control point | Enforcement location | Verified-crawler handling | Rate-limit granularity | Origin impact when rejecting | Logging and rollback | Compatibility considerations | Cost or availability |
|---|---|---|---|---|---|---|---|
| CDN/WAF reverse proxy | Edge, before the host | Can provide verified-bot controls; Cloudflare documents Googlebot and Bingbot as examples | Can target paths, methods, IPs, or request rates, depending on the service | Lowest, because rejected requests do not invoke WordPress | Centralized analytics and rule controls; retain a tested rollback | Preserve client-IP headers, APIs, XML-RPC exceptions, and cache behavior | Plan, region, and feature availability vary; no universal price is established here |
| Web-server rules | Origin web server, before PHP when configured there | Requires your own identity checks and exception rules | Depends on the server module and hosting access | Lower than a plugin, but the connection still reaches the host | Use server access/error logs and version-controlled configuration | Incorrect rules can affect every virtual host or integration | Requires server-level access; availability depends on the host |
| WordPress plugin | Inside or immediately around WordPress | Depends on the plugin’s categories and your allowlist | May support global, category, IP, or path thresholds, depending on the plugin | Higher: PHP or the must-use plugin can run before rejection | Use plugin logs plus origin monitoring; keep a disable path | Test themes, caching, REST/API calls, XML-RPC, Jetpack, mobile apps, and SSO | Program and maintenance status vary; review the official directory listing |
robots.txt |
Cooperative crawler guidance | Only crawlers that choose to comply | None; it does not throttle a hostile client | None for an ignoring client | Review the served file and crawler logs | Do not use it as a security control or to hide content that must be removed from search | Available on every WordPress site, with no firewall enforcement |
3. Rate-limit /wp-login.php and /xmlrpc.php
Protect the login endpoint
Brute-force programs commonly send repeated POST requests to /wp-login.php. Apply a limit at the edge or web server based on request rate and, where possible, distinguish failed authentication attempts from normal page views. Do not set a threshold so low that a shared office, school, or mobile carrier address locks out legitimate users.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhen a limit is reached, log the decision and return the response your security layer is designed to use. Monitor failed-logins, successful-logins, 4xx responses, and support reports together; a drop in requests is not useful if real users can no longer sign in.
Decide whether XML-RPC is required
If your site does not use XML-RPC, disable it or block requests to /xmlrpc.php before they reach WordPress. If Jetpack, a mobile application, or another documented integration requires it, retain the endpoint but apply a narrow rate limit and an explicit exception for that flow. Document the exception, owner, and reason so a future administrator does not remove the protection or open the endpoint to everyone.
Apply the same principle to REST and other APIs: identify the clients that need them, then limit abusive patterns rather than disabling a service that the site depends on.
4. Keep legitimate search crawlers working
Cloudflare documents verified bots, including Googlebot and Bingbot, and warns that anti-bot modules can create crawl errors. A user-agent string alone is not a reliable identity check: an abusive client can copy “Googlebot.” Use your edge provider’s verified-bot feature or independently validate crawler identity before granting an exception.
Recommended Free Tools
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Do not create a blanket block for every crawler or every request with a bot-like user agent.
- Review crawler exceptions whenever you change DNS, the WAF, server configuration, or TLS termination.
- Check search-console crawl errors and server logs after deployment.
- Remove broad blocks in
.htaccess, server configuration, orrobots.txtif they are preventing a legitimate crawler from reaching indexable pages.
Verification and least privilege belong together: allow the crawler identity only the paths it needs, and continue to rate-limit endpoints such as login and XML-RPC even when the visitor is a verified crawler.
5. Use robots.txt for crawl guidance, not security
A robots.txt file tells cooperative crawlers which locations they are asked to check. It cannot stop a hostile client, consume fewer resources on its own, or protect a private URL. WordPress’s SEO documentation recommends page-level noindex for low-quality content and explains that the file communicates crawl permissions.
For example, if your site has a dedicated search path and a filter path, a deliberately narrow file might look like this:
User-agent: *
Disallow: /search/
Disallow: /catalog/?filter=Replace those paths with the URL patterns your own logs identify. Test the resulting file at the site root, and remember that query-string handling differs among crawlers. Do not disallow a page merely because you need it removed from search: a crawler may need to fetch it to see a page-level noindex directive. Use an edge or server rule when the requirement is enforcement rather than guidance.
6. Add WordPress-level throttling only when earlier layers are unavailable
A plugin is a practical fallback for a site that cannot use a CDN/WAF or server configuration. It is not equivalent to an edge firewall: the request has already reached the origin, and WordPress or a must-use plugin may spend resources deciding to reject it.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Bottle
Bottle is listed in the official WordPress plugin directory and can terminate WordPress processing when a throttle condition is reached. Before enabling it, identify which requests it examines, where its logs are written, how limits are configured, and how to disable it if the administrator is locked out.
PSB Bot Traffic Controller
PSB Bot Traffic Controller is also listed in the official directory. Its description says that it intercepts early through a must-use plugin and supports category and global rate thresholds. “Early” does not mean “at the edge”: the code still belongs to the WordPress installation and must be maintained with the rest of the site.
Plugin due diligence
- Check the current WordPress and PHP compatibility information, update history, support activity, and documentation.
- Confirm that logging identifies the rule, client, path, and reason for rejection.
- Test administrator login, password reset, REST requests, XML-RPC integrations, Jetpack, mobile apps, SSO, cron jobs, feeds, and cached pages.
- Keep a hosting-panel or file-access method for disabling the plugin if the dashboard becomes inaccessible.
A practical deployment sequence
- Baseline: capture bot analytics, origin logs, top paths, user agents, request rates, status codes, cache results, and PHP/CPU indicators.
- Map dependencies: list every legitimate client that uses login, XML-RPC, REST, feeds, search, or filtered URLs. Record the required paths and expected traffic pattern.
- Choose the earliest available control: use a reverse-proxy WAF first, then web-server rules, and only then a WordPress plugin.
- Deploy one narrow rule: start with the clearest abusive path or rate pattern. Avoid changing several unrelated controls at once, or you will not know which change caused a failure.
- Protect sensitive endpoints: rate-limit
/wp-login.phpand/xmlrpc.php; disable XML-RPC only after confirming that no required integration uses it. - Configure crawler exceptions: use verified-bot controls or identity validation. Never trust a copied user-agent string by itself.
- Add crawl guidance: use
robots.txtfor low-value areas and page-levelnoindexwhere appropriate; do not treat either as a firewall. - Observe: compare the same metrics used for the baseline, including origin CPU, PHP workers, response codes, crawl errors, login success, API health, and support reports.
- Document and roll back: write down each rule, exception, owner, date, and disable procedure. Revert a rule that causes unexplained errors rather than stacking another rule on top of it.
Troubleshoot the common failure modes
Real visitors are receiving blocks or rate-limit responses
Find the matching log entry, then narrow the rule by path, method, identity, or a more appropriate client key. Shared IP addresses can represent many people, so an IP-only threshold may be unsuitable for public login pages. Add a documented exception only after confirming the traffic is legitimate.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Google or Bing reports crawl errors
Inspect edge decisions and server rules for blanket crawler blocks. Remove blocks aimed at generic “bot” user agents, enable verified-bot handling where available, and test the affected URL as an ordinary page request. Do not solve a crawl problem by allowing every automated client.
Requests continue even after editing robots.txt
That is expected for a client that ignores the file. Move enforcement to the reverse proxy or web server, where the request can be rejected before WordPress processing. Keep the crawl directive only if it remains useful to cooperative crawlers.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
An integration stops working after XML-RPC protection is enabled
Identify whether Jetpack, a mobile app, or another integration is sending the request. Restore only the required flow, then apply a narrow exception and rate limit. Do not reopen XML-RPC globally without recording why it is needed.
The plugin itself adds noticeable load
Compare its execution time and PHP usage with the baseline. If a plugin is evaluating large numbers of requests at the origin, disable it temporarily and move the same logic to the edge or web server. Keep the plugin only when its compatibility and resource cost are acceptable.
What to monitor after deployment
- Requests per minute reaching the origin, separated by path and decision.
- PHP worker utilization, CPU, memory, database time, and slow requests.
- 4xx and 5xx responses, including rate-limit responses and login failures.
- Cache hit and miss behavior for the URLs affected by a rule.
- Successful administrator logins, API calls, XML-RPC integrations, Jetpack or mobile activity, and SSO flows.
- Verified-crawler requests and search-console crawl errors.
Keep the before-and-after windows comparable and report what your measurements show. Bot controls are an operating process, not a one-time switch: new user agents, URL patterns, integrations, and WordPress updates can change the correct rule.
The Bottom Line
Measure first, reject abusive requests at the earliest reliable layer, rate-limit login and XML-RPC with documented exceptions, preserve verified crawlers, and reserve WordPress plugins for cases where edge or server controls are unavailable. Use robots.txt to guide cooperative crawlers, never as a security barrier.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
