Tweet
What are the bad bots in WordPress, and how do you block them?
-
-
Bad bots are automated programs or scripts that crawl websites with harmful intent. These bots can consume server resources, steal content, spam forms, and even try to exploit security vulnerabilities.
One everyday activity is content scraping, where bots copy your blog posts or product listings to use elsewhere, resulting in duplicate content issues and potential SEO penalties.
More dangerous bots attempt brute-force attacks, trying thousands of username and password combinations to break into your site.
-
You can block bad bots on your WordPress site using a plugin or manual methods. Using a security plugin is the easiest and most reliable option, as these tools are regularly updated to automatically detect and block new threats.
1. Block Bots via .htaccess
You can block bots by adding rules to your .htaccess file.
If you have not found the .htaccess file in cPanel, then click on Settings and select the Show Hidden Files option.
image.png
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.(badbot1|badbot2|crawlerx).$ [NC]
RewriteRule .* - [F,L]
</IfModule>
--> Replace badbot1, badbot2, etc., with your bot names.
2. Use robots.txt to Disallow Crawlers
The robots.txt file can be used to instruct bots not to crawl specific parts of your site.
User-agent: BadBotName
Disallow: /
3. Block by IP address
Add the below rule in your .htaccess file.
<Limit GET POST>
Order Allow,Deny
Allow from all
Deny from 0.0.0.0
</Limit>
4. Disable XML-RPC
XML-RPC is a WordPress feature that enables remote access to your site; however, it is often targeted by bots for brute force and other malicious attacks.
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from 0.0.0.0
</Files>Comment
Comment