Bot protection

Bot protection decides what happens to automated traffic before it reaches WordPress. Open your site, then Bot protection, to pick a mode and set exceptions for the environment you are looking at.

Pick a protection level

1. Open your site, then Bot protection.
2. Under Protection level, choose Change.
3. Pick a level:
   • Off keeps only the baseline protection below.
   • Normal asks visitors whose browser looks like a script, such as curl, Python, headless Chrome, or no user agent at all, to pass a quick challenge. People and good bots are not affected.
   • Strict blocks those clients outright, and very old HTTP/1.0 clients too. Use it when a scraper or attack does not stop.
4. Save.

Avaloi applies the level through a job. Normal and Strict run as Cloudflare rules that every site on Avaloi shares. When those rules are full, the tab says so and the level waits until there is room.

Let verified bots through

Allow verified bots is on by default, so search engines, uptime monitors, and other bots Cloudflare has verified always pass. Turn it off only to stop crawlers.

Exceptions

Choose Add exception to let a path, such as a webhook URL, or an IP address or range, such as your office, skip bot protection. Remove an exception from its three dot menu.

Always on

Every site blocks requests for wp-config.php, .env, .git, debug.log, PHP files in uploads, XML-RPC, and author scans on the home page. Every site also limits each address to 5 requests to wp-login.php every 10 seconds, then blocks it for 10 seconds.

Read the traffic counts

The Activity card shows requests, challenges, and blocks for the last 24 hours once Cloudflare analytics are connected. Until then it says the counts are not available yet.

Limits

• Login protection: 5 requests every 10 seconds to wp-login.php from one address, then a 10 second block.
• Traffic counts cover the last 24 hours.

Quick answers

A service that calls my site gets challenged. Add its path or its address to the skip list.

Will Google still crawl my site in Strict mode? Yes, while Allow verified bots is on.

I cannot log in and see a block page. Your address sent more than 5 login requests in 10 seconds. Wait 10 seconds and try again.

The tab says the shared Cloudflare rules are full. Your level is saved but not enforced yet. The baseline protection still applies. Try again later or contact support.

API

• GET /v1/environments/{id}/bot-protection
• PUT /v1/environments/{id}/bot-protection
• GET /v1/environments/{id}/bot-protection/stats

Related

• IP deny
• Edge cache and CDN
• Analytics