The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Stop abusive requests before WordPress starts PHP or database work. First identify which dynamic paths are receiving automated traffic, then enforce endpoint-specific rules at an edge WAF or CDN. Add targeted controls for wp-login.php and xmlrpc.php, protect the REST API without breaking legitimate clients, and create explicit exceptions for monitoring, deployment, and partner integrations.
Why cached pages do not stop this traffic
Page caching helps when a request can be served as a stored document. Dynamic endpoints are different: they commonly invoke PHP, authentication checks, plugins, database queries, or outbound API calls before a response is produced. A bot can therefore consume CPU, PHP workers, memory, and MySQL capacity even when the site’s public pages are cached.
Recommended Free Tools
The useful control point is the earliest one you operate. An edge WAF or CDN can discard, challenge, or throttle a request before it reaches the origin server. A web-server rule is the next layer, followed by WordPress-level defenses. Controls applied only inside WordPress still require the request to reach PHP, so they are valuable as defense in depth but are not a substitute for edge filtering.
Which WordPress endpoints attract bots?
Begin with access logs and CDN or WAF analytics rather than a generic block list. Record the path, HTTP method, authentication state, status code, requester identity, and an estimate of backend cost. The same URL can be harmless on a GET and expensive on a POST.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
| Endpoint or class | Why it is dynamic | Useful first controls |
|---|---|---|
/wp-login.php |
Performs authentication, session, and sometimes password-reset work. | Unauthenticated rate limit, challenge after a small burst, temporary IP bans, and monitoring for repeated failures. |
/xmlrpc.php |
Accepts XML-RPC method calls that can trigger authentication or publishing integrations. | Disable when unused; otherwise preserve the required integration and throttle other traffic. |
/wp-json/ and REST routes |
The REST index and resource routes expose dynamic, often JSON-producing handlers. Public and authenticated data can coexist. | Separate public and authenticated policies, use method and path conditions, and allow known clients explicitly. |
| Search and query URLs | Search, filtering, and uncached query parameters can perform database work on every request. | Rate-limit expensive methods or parameters; use response-code and cache-miss telemetry to find abuse. |
| Form handlers and plugin AJAX routes | Contact, checkout, account, and plugin actions execute application logic and may write to the database. | Match the exact route and method, require expected headers or authentication where appropriate, and apply stricter limits to state-changing requests. |
Keep the inventory current. Plugins and themes can add routes, and a bot may reach the same handler through alternate URL encodings or a different but equivalent path. Review normalized paths in the edge dashboard and origin logs before assuming a rule covers every variant.
What the WordPress REST API means for bot protection
The REST API is a discoverable dynamic surface, not a single page that can safely be blocked in every installation. A GET request to /wp-json/ returns the REST API index, and WordPress uses predictable, resource-oriented URLs for routes. Public endpoints and authenticated endpoints may operate on the same site, so a blanket deny can break mobile apps, editors, analytics, commerce, or partner software.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteClassify routes by function and authentication state. Public read-only requests can usually receive a different limit from authenticated writes. For example, a public collection route may tolerate short bursts, while an authenticated POST that creates or updates content deserves a lower threshold and stronger verification. Do not infer that a request is safe solely from its path; inspect the method, authentication headers, and response behavior as well.
Put an edge WAF or CDN in front of the origin
Use an edge security service or a host-provided WAF as the primary enforcement point. WordPress security guidance recommends this arrangement because abusive traffic is stopped before it reaches the server. The product names and dashboard labels vary, but the policy design is consistent: match a request expression, count it over a window, and choose an action when the limit is exceeded.
- Route the site’s DNS and traffic through the edge service. Confirm that the protected hostname is actually proxied; a DNS-only hostname sends requests directly to the origin and bypasses the WAF.
- Define the matching expression. Include the hostname, normalized path, HTTP method, and, when useful, authentication or header conditions. A rule for all traffic to a domain is rarely as safe as one for a specific endpoint.
- Choose a counting key. Per IP is a starting point, but authenticated APIs may need a key based on a token, account, or another stable client identifier. Avoid trusting a client-supplied forwarding header unless the edge overwrites it from a trusted connection.
- Select the action. Throttle can preserve service for bursts, a challenge can distinguish browsers from simple scripts, and block is appropriate for clearly abusive traffic. Decide which HTTP status the client receives and make sure legitimate software can handle it.
- Log and review the rule. Check matched requests, status codes, and origin volume before making the policy permanent. A rule that never matches may indicate a path-normalization or proxy-coverage problem.
Cloudflare describes this model as rate-limiting rules that match an expression and perform an action when a limit is reached. Its API guidance also recommends path and method checks, optional headers or schema checks, and exceptions for known clients. Other WAFs expose equivalent concepts under different names.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Build endpoint-aware rate limits
There is no site-independent requests-per-minute number that is safe for every WordPress installation. Establish a baseline from normal traffic, then account for endpoint cost, authentication state, expected bursts, and the consequences of a false positive. A small site with a costly search query may need a stricter policy than a busy site serving inexpensive public reads.
| Traffic class | Policy design | Reason |
|---|---|---|
| Unauthenticated login, registration, and password reset | Low burst allowance, short window, challenge or temporary block after repeated failures; monitor by IP and, where possible, account identifier. | These actions are attractive for credential stuffing and can be expensive even when every attempt fails. |
| Unauthenticated public REST reads | Moderate, path-specific limit with a separate rule for expensive collections or query parameters. | Public data may be legitimate, but unrestricted enumeration can consume application and database resources. |
| Authenticated REST reads | Count by account or token as well as IP, with a higher allowance that reflects real client behavior. | Many users or services may share a corporate NAT address; an IP-only limit can block unrelated clients. |
| Authenticated writes and other POST actions | Stricter method-specific limit, with an explicit client exception and stronger anomaly logging. | Writes often trigger validation, hooks, cache invalidation, and database changes. |
| XML-RPC | Disable if unused; otherwise allow only the required integration pattern and throttle the remainder. | XML-RPC is a single endpoint that can carry several methods, including authentication-related work. |
Use response codes as signals. A source repeatedly generating 403 or 404 responses across many paths is often probing rather than browsing. A sudden increase in 401 responses on login or API routes can indicate credential attempts. These signals can feed a separate rule without penalizing normal successful traffic.
Protect wp-login.php without locking out administrators
Keep the login page reachable for genuine administrators, but make automated guessing costly. Start with an unauthenticated rule that matches the exact path and relevant methods. A GET that displays the form does not need the same treatment as repeated POST failures.
- Track failed POST responses and apply a progressive delay, challenge, or temporary block rather than permanently banning a shared office or mobile IP.
- Use multifactor authentication and strong passwords at the WordPress layer; edge throttling reduces volume but does not replace account security.
- If administrators use a fixed corporate network or VPN, add a narrowly scoped exception and monitor it. Do not allow an entire provider or country merely because it contains your own address.
- Keep password-reset controls separate. A reset endpoint can be abused for mail floods even when login attempts are quiet.
Test from an allowed administrative network and an ordinary external connection. Confirm that successful login, failed-login throttling, password reset, and any API client using the same authentication domain behave as intended.
Make an explicit XML-RPC decision
Do not block XML-RPC by habit. First identify whether Jetpack or another publishing, mobile, or management integration requires it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
When no integration needs XML-RPC
Disable the endpoint at the edge, web server, or WordPress configuration layer. Verify that the response is consistent and that no scheduled job or external application depends on it. Removing an unused dynamic surface is simpler than maintaining a permanent exception.
When an integration requires XML-RPC
Preserve the documented request pattern for that integration, then rate-limit or challenge other XML-RPC traffic. Cloudflare documents a managed WP0007 protection for Jetpack traffic. Match the required pattern as narrowly as possible and monitor failures after deployment.
Why a blanket block can be the wrong emergency fix
A rule that denies every request to /xmlrpc.php also denies legitimate calls. Cloudflare describes an all-XML-RPC block as an emergency measure because it disables the endpoint. If the goal is to stop abuse while retaining a dependency, use an exception-first policy instead of a universal deny.
Use bot controls with allowlists and skip rules
Bot detection, browser challenges, and managed signatures can remove obvious automation, but broad controls can interfere with useful software. Monitoring services, CI/CD pipelines, partner APIs, uptime checks, and internal jobs may not behave like browsers. Cloudflare warns that Bot Fight Mode can affect legitimate automated API traffic; its domain-wide behavior also means that path-specific thresholds may require more advanced Bot Management.
- List known automation before enabling a broad action. Record the service, source addresses or verified identity, paths, methods, and expected schedule.
- Create the exception first. Use a verified provider identity, a stable IP range, mTLS, a signed header, or another signal that the client actually controls. Do not rely on an arbitrary user-agent string.
- Scope the exception. Allow only the paths and methods the client needs. An uptime monitor should not receive permission to post content.
- Apply the general bot action after the exception. Challenge or throttle unknown traffic, and block only when the evidence is strong.
- Review skipped events. An exception that matches too broadly is a security hole; one that never matches will cause avoidable outages.
Add origin-layer defense in depth
Edge filtering should carry the largest load, but the origin still needs safeguards for traffic that passes the edge, misconfiguration, or an internal request.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Use web-server rules to reject clearly invalid methods or paths before WordPress loads.
- Enable WordPress or security-plugin login throttling and temporary abusive-IP bans, while ensuring the plugin does not create more PHP work than it prevents.
- Use CAPTCHA or Turnstile-style verification on high-risk interactive actions when a challenge is acceptable for users.
- Keep WordPress core, themes, and plugins updated; vulnerable components can turn a high-volume request into a much more serious incident.
- Protect the origin address so attackers cannot bypass the edge with a direct request. Restrict inbound traffic to the edge’s published ranges where your hosting arrangement permits it.
- Monitor PHP worker saturation, database connections, slow queries, memory, and queue times alongside request counts. A lower-volume endpoint can still be the costliest one.
Tune rules from evidence instead of guesses
Change one policy at a time and compare edge events with origin logs. Look for lower origin request volume, fewer expensive handler executions, stable success rates for known clients, and an absence of new support reports.
Normalize paths before matching
Equivalent encodings, repeated slashes, case differences on case-insensitive components, and unusual URL forms can evade a naïve string comparison. Confirm how the WAF normalizes a request and inspect the normalized value in event logs. Apply rules to the representation used for matching, while preserving a safe canonicalization policy at the origin.
Use status-code behavior as a detection signal
Repeated 404s across changing paths suggest scanning; repeated 403s may indicate a client testing protections; bursts of 401s on authentication routes can indicate guessing. Create a separate threshold for these patterns so a normal successful API client is not treated like a scanner.
Handle shared addresses carefully
Schools, offices, mobile carriers, and cloud providers can place many legitimate users behind one IP. Combine IP data with path, method, token, account, or verified-client signals. If an IP-based rule causes collateral blocking, lower its action from block to challenge or use a more specific counting key.
Check capacity and plan limits
WAF plans differ in available rule counts, logging depth, bot signals, and retention. Confirm that the selected tier can evaluate the expressions, retain the events needed for troubleshooting, and handle the site’s traffic volume. If a feature is unavailable, reproduce the same policy with web-server or WordPress controls rather than silently leaving the endpoint unprotected.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
A practical rollout and rollback plan
- Measure for a normal period. Export endpoint, method, status, authentication, and latency data from logs and edge analytics.
- Choose one high-cost target. Start with the path causing the most origin work, not necessarily the one with the most requests.
- Deploy in logging or simulation mode. Confirm that the expression matches the intended traffic and that known clients appear in the exception set.
- Enable a reversible action. Use throttle or challenge before a hard block when the request’s legitimacy is uncertain.
- Test user journeys. Exercise login, password reset, REST reads and writes, XML-RPC integrations, forms, checkout, cron jobs, monitoring, and deployment hooks from their real networks.
- Inspect origin metrics. Verify reductions in PHP execution, database work, and worker saturation rather than judging success only by edge counts.
- Promote or narrow the rule. Tighten the threshold for confirmed abuse, or add a constrained exception when a legitimate client was challenged.
- Document rollback. Keep the prior expression and action available, record the change owner, and define which symptom triggers an immediate revert.
Troubleshooting common failures
“The rule says it blocked bots, but PHP is still busy.”
Check whether the hostname is proxied, whether the traffic is reaching a different hostname or direct origin address, and whether the expression matches the normalized path. Review origin access logs for alternate encodings and plugin routes that were not included in the inventory.
“A mobile app or partner API started returning challenges.”
Identify its stable authentication and network signals, then create a path- and method-scoped skip rule. Avoid allowing all traffic from a broad cloud provider. Re-test the exact request sequence, including refresh tokens and retries.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“The REST API works for reads but writes fail.”
Compare methods, authentication headers, content type, and response codes. A stricter POST policy may be matching the legitimate client, or a schema/header check may not account for its request format. Adjust the exception or policy only for the required route and method.
“Blocking XML-RPC broke publishing.”
Restore the endpoint temporarily, identify the integration’s documented request pattern, and implement an allowlist plus a rate limit. If no integration remains, disable it again after confirming that scheduled and mobile workflows no longer use it.
“A single IP keeps changing paths and receiving 404s.”
Use a response-code-aware rule or temporary ban for the scanning pattern, with a limit that will not punish a legitimate crawler encountering one missing page. Combine the signal with request rate and path diversity.
Quick Recap
What a successful configuration looks like
- Dynamic paths are listed from actual logs, including plugin and form routes.
- Unauthenticated and authenticated API traffic have separate policies.
- POST and other state-changing methods receive stricter treatment than inexpensive reads.
- Known monitoring, deployment, and partner clients have narrow, tested exceptions.
- XML-RPC is either disabled with no dependency or protected around a documented integration.
- Edge events, origin CPU, PHP workers, database load, response codes, and false positives are reviewed together.
- Rules account for normalized URLs and can be rolled back without editing application code during an incident.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
