Announcement
Bottle: a free WordPress plugin for mitigating bot traffic.
Tecture has released Bottle, a free, open-source bot throttling plugin that holds back the surge of artificial traffic hitting WordPress websites.
Overview
A surge of unwanted traffic
WordPress sites are being flooded by LLM crawlers, botnets, scrapers and automated vulnerability scans. Several trends are coming together to drive the surge:
AI training crawlers
As AI models grow, web scrapers crawl sites aggressively for training data.
Exploit scanning
Automated PHP and WordPress exploit scans are increasing, sped up by AI tools that find vulnerabilities.
Bigger botnets
Compromised IoT devices widen the reach and volume of botnet attacks.
All of this automated traffic slows sites down and causes unexpected outages. Our goal with Bottle is to protect performance, preserve uptime, keep hosting costs under control and protect the experience of human visitors, without intrusive deterrents.
Background
What we saw in our own hosting
Tecture has hosted and managed WordPress websites for many years. These sites typically mix static content with transactions, and connect to back-end business systems and third-party platforms through APIs. For a long time, routine WordPress updates were enough to keep them stable and secure. Then we started getting more outage alerts, triggered by sudden spikes in traffic. Our log analysis tied those spikes closely to automated bot activity.
The surges fell into three groups, each needing its own response:
1
Short bursts of traffic from a single IP address.
2
LLM bot traffic from recognizable IP ranges, with honest user-agent strings.
3
Distributed requests from rapidly rotating IP addresses with legitimate-looking user agents, which are hard to tell apart from real people.
At first we blocked problem addresses with standard firewall rules and iptables, but the bots quickly moved to new IPs. We needed an adaptive solution that could detect and respond to changing traffic on its own.
WordPress performance
Why bots hit WordPress so hard
WordPress's architecture makes it hard to defend against high volumes of automated requests. It's built on PHP, an interpreted language, so each request is compiled and run on the fly. PHP is stateless, so every request sets up its environment from scratch. Without built-in multithreading or connection pooling, WordPress leans heavily on the server's process management, and handling lots of dynamic pages takes serious tuning and caching.
The flexibility that made WordPress popular, its hooks and plugin architecture, also adds cost. Every installed plugin loads and runs on every request, whether the visitor is a person or a bot, and whether or not the page needs that plugin.
Static files cache well, but bots often request pages that don't exist or can't be cached. Caching layers like Varnish deliberately skip 404 responses, so WordPress runs its full PHP start-up for every missing page. When a scan fires thousands of 404 requests in a short window, the server runs out of CPU and memory, and the site slows badly or crashes.
The options
Common fixes, and their trade-offs
Cloud firewalls
Services such as Cloudflare work well.
But you hand DNS to a third party, and they can't stop direct attacks on your server if its IP address is exposed.
Security plugins
Standard WordPress security plugins add protection.
But they often lack adaptive throttling, and because they run inside the full WordPress cycle, they still use a lot of resources under heavy load.
Proof-of-work gateways
Tools such as Anubis filter out non-human traffic effectively.
But they can add friction for regular visitors.
Our solution
Bottle: lightweight, adaptive throttling
Bottle takes a hybrid approach. It works as a lightweight defense on its own, or as a second safety net behind a cloud firewall.
Stops abuse early. Bottle spots abusive traffic patterns early and ends processing before WordPress's core components load.
Low overhead. It makes no database queries while checking requests, and keeps throttle state in memory using an object cache such as Redis.
Friendly to people. If a real person is throttled, they pass a built-in proof-of-work check (or an optional Cloudflare Turnstile widget) and carry on.
Visibility for admins. A request tracking dashboard shows live requests and how Bottle handles each one, and a heatmap shows bot activity and IP verification status.
Why make this?
Reliable sites without the bot tax
Serving pages freely to malicious bots and aggressive crawlers raises hosting costs, eats bandwidth and risks downtime for real customers. Bottle cuts that overhead while keeping sites available.
By open-sourcing Bottle, we want to give WordPress site owners and developers a simple, effective way to deal with modern bot traffic without giving up performance or user experience. As scraping and exploit scans keep growing, lightweight, adaptive throttling is a practical way to keep infrastructure reliable.
Is bot traffic slowing your WordPress site?
Our developers host, tune and protect complex WordPress sites. Tell us what you're seeing.