Blocking Bad Bots

Blocking Malicious Bots and Scrapers

Bad bots consume server resources, scrape content, and probe for vulnerabilities. BlitzPress includes the 7G WAF ruleset which blocks many known attack patterns. Here is how to add additional bot protection.

7G WAF Bot Protection

The 7G Web Application Firewall (by Perishable Press) blocks known malicious bots, bad referrers, and attack strings. It is included in BlitzPress by default and applied at the OLS level for maximum performance.

Identifying Bad Bots

Check your access logs for suspicious bot activity:

# Top User-Agents
awk -F\" '{print $6}' /home/DOMAIN/logs/access.log | sort | uniq -c | sort -rn | head -30

# Find aggressive crawlers (100+ requests)
awk '{print $1}' /home/DOMAIN/logs/access.log | sort | uniq -c | sort -rn | head -20

Blocking by User-Agent in OLS

Add rewrite rules to your vhost config to block specific bots:

RewriteCond %{HTTP_USER_AGENT} (AhrefsBot|SemrushBot|MJ12bot|DotBot|BLEXBot) [NC]
RewriteRule .* - [F,L]

Blocking by IP

For specific abusive IPs, use fail2ban or UFW:

# Immediate block
sudo ufw deny from 1.2.3.4

# Block a range
sudo ufw deny from 1.2.3.0/24

Cloudflare Bot Management

If using Cloudflare, leverage their bot management features:

• Bot Fight Mode (free) — challenges detected bots with JavaScript
• Firewall Rules — create custom rules based on User-Agent, country, or threat score
• Rate Limiting — block IPs that exceed request thresholds

Example Cloudflare firewall rule to block aggressive bots:

Expression: (cf.client.bot) and not (cf.bot_management.verified_bot)
Action: Block

Protecting wp-login.php

Bots commonly target the login page. Add rate limiting:

# In OLS rewrite rules - block direct POST to wp-login from bots
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} (bot|crawler|spider) [NC]
RewriteRule ^wp-login\.php - [F,L]

robots.txt

While robots.txt only works for well-behaved bots, it reduces unnecessary crawling:

User-agent: AhrefsBot
Disallow: /

User-agent: SemrushBot
Disallow: /

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php