Tecture has released a free, open-source WordPress bot throttling plugin—Bottle—to block the surge of artificial traffic plaguing WordPress websites. This unwanted traffic consists of LLM crawlers, botnets, scrapers, and automated security vulnerability scans. The recent surge is driven by several converging trends:
This influx of automated traffic creates performance degradation and unexpected outages. Our objective with Bottle is to protect performance, preserve uptime, keep hosting costs manageable, and safeguard human user experience without relying on intrusive deterrence measures.
Tecture has managed and hosted WordPress websites for many years. Typically, these sites combine static content with transactional elements and integrate with backend business systems and third-party platforms via APIs. Historically, routine WordPress updates were sufficient to maintain stability and security. However, we began noticing a higher frequency of outage alerts driven by sudden traffic spikes. Log analysis revealed a strong correlation between these spikes and automated bot activity.
These traffic surges generally fall into three distinct categories, each requiring a tailored response:
Distributed requests with rapidly rotating IP addresses and legitimate user agents, making them difficult to distinguish from genuine human users.
Initially, standard firewall rules and iptables were used to block problematic IP addresses. However, bot activity quickly adapted by shifting to new IPs. This demonstrated the need for an adaptive solution capable of dynamically detecting and responding to changing traffic behavior.
WordPress’s underlying architecture presents inherent challenges when defending against high-volume automated requests.
Because WordPress is built on PHP, an interpreted language, requests are compiled and executed dynamically. PHP execution is stateless, meaning each request initializes environment state from scratch. Without native multithreading or connection pooling, WordPress relies heavily on server process management. Consequently, achieving high throughput on dynamic pages requires substantial tuning and caching strategies.
Furthermore, the extensibility that makes WordPress popular—its plugin and action hook ecosystem—adds execution overhead. Installed plugins execute on every incoming request, regardless of whether the requester is a human or a bot, or whether that code is required for the requested resource.
The very things that have led to the popularity of WordPress — it’s flexibility and extensibility, achieved through hooks and a plugin architecture — lead to sites bloated with add-on software that also incurs a significant execution cost. These add-ons (called plugins) will load and initialize for each and every request, regardless of whether that request is a human or a bot, and regardless of whether that software is actually needed on the page.
While static assets can be efficiently cached, bot requests frequently target non-existent URLs or uncacheable endpoints. Standard caching layers like Varnish intentionally bypass caching for 404 responses, forcing WordPress to execute full PHP bootstrap cycles for every missing page requested.
When scanning tools generate thousands of 404 requests in a short window, server CPU and memory allocation are quickly exhausted. This leads to severe performance degradation or server crashes when memory limits are exceeded.
Several standard approaches exist for handling unwanted web traffic, each with trade-offs:
Bottle provides a hybrid approach, serving as a lightweight standalone defense or as a secondary safety net behind existing cloud firewalls.
The plugin detects abusive traffic patterns early in execution and immediately terminates processing before core WordPress components load. Designed for low overhead, it avoids database queries during evaluation and tracks throttle states in memory using an object cache like Redis.
When a non-bot request is throttled, legitimate human users can solve an integrated Proof-of-Work challenge (or optional Cloudflare Turnstile widget) to proceed uninterrupted.
To assist site administrators with configuration, the plugin includes a request tracking dashboard to monitor traffic so you can check real-time requests and observe how Bottle evaluates them. And we include a heatmap showing bot activity and IP address verification status, so you can be better informed about the extent of bot activity on your site.
Serving unthrottled pages to malicious bots or aggressive crawlers inflates hosting costs, consumes excess bandwidth, and risks downtime for real customers. Bottle mitigates these overhead costs while maintaining high availability.
By open-sourcing Bottle, Tecture aims to provide WordPress site owners and developers with a simple, effective tool to mitigate modern bot traffic without sacrificing site performance or user experience. As automated scraping and exploit scans continue to rise, lightweight and adaptive throttling offers a practical defense strategy for maintaining reliable infrastructure.