WordPress Security and Performance FAQs

What configuration of WordPress provides optimal performance for a high traffic, transactional website?

We host many high traffic WordPress websites, and have found that several key techniques must be leveraged to achieve high performance. It is very difficult/impossible to load balance a transactional WordPress website, so one must rely on a single server.

  • Varnish cache. Using varnish is an excellent way to cache both static pages and static content, and force browser caching.
  • Opcache. The opcache must be used to cache PHP strings. However, opcache must be tuned so that it doesn't fill up, which will cause performance degradation. The OPcache Status page can be used to monitor key opcache parameters such as used memory, free memory, the number of strings, etc. This fine tuning article recommends tuning memory_consumption, interned_strings_buffer, and max_accelerated files.
  • Redis. Redis and the Redis Object Cache plugin are essential for caching objects and database calls. Another advantage of Redis is that get_transient and set_transient will use a memory cache instead of database. Tuning Redis with an eviction policy and max memory threshold are essential ways to keep Redis fast.
  • Moving the database to another server or a hosted database server, such as RDS. This can provide additional security and redundancy.
  • Blocking or throttling bots or excessive users. A throttling plugin such as Bottle can help in high traffic scenarios or DDOS attacks. CloudFlare is an alternative solution in which your domain is proxied through CloudFlare to your web server and may also be beneficial. If you choose a plugin-based solution, we recommend one that is a mu (must-use) plugin and evaluates the HTTP client request before all of WordPress is completely loaded.
What is the best technique to prevent WordPress website bot attacks?

You can use CloudFlare or a security plugin such as Bottle to mitigate bot or DDOS attacks on your WordPress website.

Many advocate for blocking user agents or IP addresses. Blocking IPs is akin to playing "whack-a-mole" as you are constantly chasing rotating IP addresses. User agents can be easily forged and cannot be trusted.

In our view, the best approach is to configure throttles that detect and temporarily block excessive traffic. Such throttles should respond with HTTP code 429 (throttled) so that well-designed bots will see that they should reduce their traffic and return later.

Is there a way to allow legitimate traffic / humans through to the website?

When under extreme attack, Bottle has an "overall" throttle. This is the throttle of last resort, and it's exceptionally useful when a bot net with malicious bots are effectively performing a DDOS attack on a site. This generally manifests as rapidly rotating IP addresses making requests for URLs that match a particular pattern.

For instance, a website might have a /courses catalog, and bots might begin rapidly making requests for numerous URLs matching /courses/{course title}. (Those AI bots are hungry for corpus.) The "overall" throttle setting can detect that excessive requests have been made for URLs matching that pattern and then block ALL traffic as a last resort. This is exceptionally good at keeping sites online when under attack, but it does have the downside of impacting legitimate human users.

One possible solution is the Proof-of-Work popularized by Anubis. Bottle includes a simple PoW setting that allows a non-bot client to solve a small cryptographic puzzle and submit its solution in exchange for access. While this is a minor inconvenience (and not foolproof, as some bots can solve such puzzles), it does allow humans access, even when throttle conditions are blocking certain other traffic.

What is the best security plugin for WordPress?

Most WordPress plugins are insufficient to provide the performance necessary to repel bot and DDOS attacks. There are several reasons for this:

  • Many security plugins use database tables to log requests, favoring a sophisticated UI over performance.
  • WordPress + theme + plugin load is computationally expensive and time consuming, and loading all of WordPress to block an attack is not desirable.
  • Many security plugins rely on user agent to determine the identity of a bot. This is problematic for requests that spoof the user agent.

It is possible to design a plugin that can offer good performance, however, if the following architecture is followed:

  • Logging should be minimized.
  • WordPress loading should be short-circuited as early as possible. This is possible to do with a mu "must use" plugin as it can load before all of WordPress and plugins have loaded.
  • No request should be trusted.

One such plugin that meets these criteria is Bottle.

Why do most WordPress security plugins fail under high traffic attacks?

For two reasons.

First, WordPress is its own worst enemy. It's extremely powerful, and its plugin architecture offers tremendous extensibility, but it's also time consuming to fully load WordPress to process each request.

Second, many plugin developers "over design" their plugins to entice customers. To accomplish this, many of them use database tables for logging requests.

When under attack, the time-consuming WordPress load coupled with database processing can cripple a WordPress website.

An alternate approach is to short-circuit WordPress loading when a throttle condition is met, and keep the design of the plugin to be minimal.

What kind of bots are accessing my website?

You would be astonished! A good way to get a profile of traffic is to install a plugin such as Bottle that logs which user agents are accessing pages on your website. Below is an heatmap that shows user agents making web page requests, grouped hourly. Not all user agents are accurate or verifiable, as bots can forge user agents, and not all bots provide IP address verification. However, you'll see that the big search engines are crawling your site (as expected), as are the LLMs like Open AI and Anthropic. There are also scanners looking for vulnerabilities, SEO backlink checkers, services crawling for generating AI leads, research tools, spiders checking what web server/CMS you're running, website archiving systems, and much more!

Can I allow certain bots through by using user agent?

Bottle's philosophy is that we trust no one. Any bot vendor - no matter how noble their intentions - can have a bug, or an infinite loop, or a misconfiguration that could lead to excessive traffic.

For bots that publish lists of IP addresses (Apple, Microsoft, Google, Open AI, etc.), Bottle will verify requests against those lists, and will allow those verified bots a higher request rate. But any bot, verified or not, that exceeds a request rate will find themselves throttled.