Over the last 12 to 18 months we’ve seen a dramatic increase in bot traffic hitting WordPress sites. Some of it comes from legitimate AI agents and crawlers, some from malicious bots, and a lot of it from poorly coded bots that end up hammering sites without meaning to.
To deal with it, every WP Alpha server now runs Imunify Security bot protection. This article explains what it does, what it means for your site, and how to use the new Imunify Security report in your WordPress dashboard.
Why we added bot protection
The most common problem we see is on WooCommerce stores. AI agents crawl the site and hit the search function over and over, or add and remove products from the cart several times per second. Every one of those requests skips the page cache and runs through PHP and the database, so a single badly behaved bot can chew up the server resources your real customers need.
We already filter traffic from outside each site’s target countries using Cloudflare’s managed challenge (a captcha-style check). That still works well, but bots are increasingly good at getting past it, so we’ve added a second layer that runs on the server itself.
How it works
Imunify Security looks at every request that reaches your site and sorts it into one of these groups:
- Human visitors: real people browsing your site. They are never rate limited.
- Verified search engines: Googlebot, Bingbot and similar crawlers, confirmed by checking the IP address really belongs to the search engine, not just by trusting what the bot claims to be.
- Verified AI crawlers: confirmed crawlers from AI companies, such as those used by ChatGPT, Claude and Perplexity.
- Verified SEO crawlers: confirmed crawlers from SEO tools that publish their IP addresses, such as Ahrefs.
- Unverified bots: bots that name themselves but can’t be confirmed, including fake “Googlebots” and SEO tools that don’t publish their IP addresses, such as Semrush.
- Unknown automated: traffic from data centre servers that looks automated but doesn’t say what it is.
- Malicious bots: known hacking and vulnerability scanning tools, and bots caught in hidden traps that real visitors never see.
Each group gets a different speed limit, measured in requests per minute from the same IP address. Here are the limits on the Balanced setting, which is what every WP Alpha site uses by default:
| Traffic type | Limit (requests per minute) |
|---|---|
| Human visitors | No limit |
| Verified search engines | 300 |
| Verified SEO crawlers | 60 |
| Verified AI crawlers | 10 |
| Unknown automated | 5 |
| Unverified bots | 2 |
| Malicious bots | Blocked |
Some traffic is always allowed through, whatever the setting: WooCommerce cart and checkout pages, payment gateway callbacks, WordPress’s own internal requests, and popular uptime monitors including UptimeRobot, Pingdom, StatusCake, Site24x7, HetrixTools and updown.io. Your checkout and payments won’t be caught by the limits.
When a bot goes over its limit, it gets a “429 Too Many Requests” response and has to slow down. A bot that keeps breaking its limit gets blocked for longer. Malicious bots are refused outright with a “403 Forbidden” response.
Alongside this, suspicious traffic at the server level is sent to a captcha-style check before it reaches your site. That’s a tougher test than Cloudflare’s challenge, and real visitors who happen to be caught by it can simply complete the check and carry on.
Will this affect my SEO or AI search visibility?
No. Search engines are verified and given a generous limit of 300 requests per minute, which is far more than Google needs to crawl a normal site. Verified AI crawlers can still read your site, so your content remains visible in ChatGPT, Google AI Overviews and other AI search tools. They just can’t hit it dozens of times a second.
What gets slowed down or blocked is the traffic that was never helping you: unverified bots, scrapers, fake crawlers and attack traffic.
Finding the Imunify Security report in WordPress
Log in to your WordPress dashboard and you’ll find Imunify Security in the left-hand menu, with a shield icon. It has two pages:
- Dashboard: an overview of your site’s security, including malware scanning, malware cleanup, the web application firewall and bot protection.
- Bot Traffic: the full report on who and what is visiting your site.
You’ll also see an Imunify Security widget on the main WordPress dashboard home screen, with a quick summary including how many bot requests were blocked in the last 24 hours.
The Imunify Security menu is only visible to users with the Administrator role.
Reading the Bot Traffic report
The Bot Traffic page covers the last 24 hours and shows:
- Share of traffic by type: how much of your traffic comes from humans compared with each type of bot. Click the arrow next to a category to see which bots are in it, then click a bot to see the IP addresses it came from.
- Top bots: the bots making the most requests, and their peak requests per minute.
- Bot requests over time: an hourly chart showing which requests were allowed, rate limited or blocked.
It’s well worth a look. Most site owners are surprised by how much of their traffic isn’t human, and it’s a useful way to see exactly which AI tools and crawlers are reading your site.
Changing the protection level
Administrators can change the setting from the bot protection section of the Imunify Security widget. There are three levels:
- Balanced (default): the limits in the table above. This is the right choice for almost every site.
- Strict: tighter limits for AI crawlers, SEO crawlers and unverified bots, and bots that break their limit are blocked sooner. Useful if your site is under heavy bot load.
- Monitor only: nothing is limited or blocked. Bot traffic is still recorded in the report.
You can also turn bot protection off for your site from the same place. We recommend leaving it on Balanced, and if something isn’t working the way you expect, talk to us before switching it off. There’s almost always a better fix than removing the protection completely.
A tool I use is being blocked. What should I do?
Some legitimate tools can look like bots: less common uptime monitors, stock or inventory sync tools, booking system integrations, or an SEO audit you run on your own site with a tool like Screaming Frog or Semrush Site Audit. Audit crawlers are the most common case, because they try to fetch hundreds of pages a minute and will be slowed right down. If one of these tools starts failing or reporting errors:
- Open Imunify Security > Bot Traffic and look for the tool in the list. You’ll see whether its requests were rate limited or blocked, and which IP addresses they came from.
- Send us the tool’s name and its IP addresses, and we’ll allow it through.
If you’re a real person and you keep seeing a captcha check on your own site, let us know your IP address (search “what is my IP” in Google to find it) and we’ll take a look.
You can reach us any time through 24/7 live chat, by logging a support ticket, or by asking our AI support agent.
Other security features on your WP Alpha account
Bot protection works alongside the security that’s already running on every WP Alpha server, including a web application firewall, daily malware scanning with automatic cleanup, and protection that stops malicious PHP code from running. For more on keeping your site secure, see:
- How to use the malware and virus scanner
- How to lock down and secure your site
- How to set up two-factor authentication
Hosting that fights the bots for you
Every WP Alpha plan includes Imunify Security bot protection, malware scanning and cleanup, and 24/7 support, so bad bots don’t eat the resources your customers need.
Moving from another host? We’ll migrate your site for free.
View WP Alpha Plans →