More than half of all web traffic now comes from bots, and a small business site is no exception. Good bots like Googlebot help you, but bad bots hammer login pages, scrape content and fill forms, using the same CPU and memory your customers need. You can usually spot them in your server logs and resource graphs, and block them at the server or firewall without touching the bots you want.
Key takeaways
- Imperva found bots made up more than 53% of all web traffic in 2025.
- Signs of bot load: resource spikes with no matching sales or enquiries, a slow admin at odd hours and junk form entries.
- Google Analytics hides known bots, so your server logs tell the real story.
- Block bad bots before they reach WordPress, at the server or an edge firewall. A plugin alone still burns resources.
- Never block real search engine crawlers. Check that a “Googlebot” really is Google first.
How much of your website traffic is bots?
Probably more than you’d guess. Imperva’s 2026 Bad Bot Report found automated traffic made up more than 53% of all web traffic in 2025, up from 51% the year before (Imperva). Bots don’t care how big your business is. They scan every address they can find.
Not all of them are a problem. It helps to sort them into three groups:
| Type | Examples | What to do |
|---|---|---|
| Good bots | Google and Bing crawlers, your uptime monitor | Allow |
| Grey bots | SEO tools, AI crawlers, price scrapers | Allow, slow down or block, your choice |
| Bad bots | Password guessers, vulnerability scanners, form spammers, card testers | Block |
AI crawlers are a decision of their own. Our guide to blocking AI crawlers covers the trade-offs.
How can you tell bots are eating your hosting resources?
Bot load rarely announces itself. It shows up as a site that feels slow for no clear reason. Look for these signs:
- Resource spikes that don’t match business. CPU or memory runs high, but sales and enquiries are normal.
- Slowness at odd hours. The admin crawls at 2am when no customer is awake.
- The same few addresses, over and over. Logs show thousands of requests to the login page, xmlrpc.php, site search or add-to-cart links.
- Junk in your forms. Spam enquiries, fake customer accounts or failed payments from strange names.
- Warnings from your host about hitting resource limits.
Password guessing alone is huge. Wordfence blocked more than 55 billion password attacks on WordPress sites in 2024 (Wordfence). WordPress’s own guidance notes that “even unsuccessful attacks can overwhelm your site with requests” (WordPress Developer Resources).
Why your analytics doesn’t show it
Google Analytics 4 automatically excludes known bots and spiders, and you can’t switch that off or see how much it removed (Google Analytics Help). So a quiet analytics report can sit beside a busy server. The bots that do show up are usually cruder ones. They create odd spikes, very short sessions and visits from places you don’t sell to, which skews your marketing numbers.
How do you block bad bots properly?
- Find out what’s hitting you. Ask your host for the top IP addresses, user agents and URLs from the last few days. The pattern usually jumps out.
- Block before WordPress loads. A firewall at the server or network edge stops a request before PHP runs. Security plugins work inside WordPress, so they still use resources under heavy attack. Our explainer on the WordPress firewall shows how the layers work.
- Protect the login and XML-RPC. Limit login attempts, add two-factor login and disable xmlrpc.php if nothing on your site uses it.
- Rate-limit expensive pages. Site search, product filters and add-to-cart links can’t be cached, so cap how often one visitor can hit them.
- Check before you block a “search engine”. Bad bots often pretend to be Googlebot. Google publishes how to confirm a real crawler using DNS lookups or its IP ranges (Google Search Central).
- Keep watching. Bots change addresses. Review logs and resource graphs monthly, or have someone do it for you.
What shouldn’t you do?
- Don’t rely on robots.txt. It’s a polite request. Good bots follow it, and bad bots ignore it.
- Don’t block whole countries blindly. You may lock out customers travelling overseas, payment providers or your own monitoring.
- Don’t put a CAPTCHA on every page. Use it where bots do damage: login, forms and checkout.
A flood of traffic meant to knock your site offline is a different problem. See our guide to DDoS protection for that. Sites handling sensitive bookings face extra stakes too, which our article on website hosting for medical practices covers.
Who should be handling this?
Most of the heavy lifting belongs at the hosting level, where bad requests can be dropped cheaply. Ask your host whether they filter traffic before it reaches your site, and what they do when one IP floods it. Our page on secure web hosting explains what to look for.
The WordPress side needs ongoing care: login protection, firewall rules and regular log reviews. Our website security monitoring includes firewall and login protection, malware scanning and blacklist monitoring. To compare resources across tiers, see our hosting plans.
Frequently asked questions
How do I know if my website traffic is from bots?
Compare your server logs or hosting statistics with Google Analytics. If the server shows far more requests than analytics shows visits, the gap is mostly bots. Repeated hits on the login page, xmlrpc.php or site search from a few IP addresses are a clear sign.
Can bot traffic slow down my website?
Yes. Every request uses server resources, and requests to uncached pages like login, search and checkout use the most. On a plan with limited CPU and memory, a steady stream of bots can leave too little for real visitors, especially at busy times.
Will blocking bots hurt my Google rankings?
Not if you only block bad bots. Problems start when a firewall rule or country block catches Googlebot by mistake. Before blocking anything that claims to be a search engine, confirm it using the DNS or IP checks Google publishes.
Is a security plugin enough to stop bad bots?
It helps, but a plugin runs inside WordPress, so each blocked request still loads PHP. Under heavy attack that uses real resources. A firewall at the server or network edge drops bad requests before they reach WordPress, and the plugin then handles what gets through.
Why do I get so many spam form submissions?
Bots find forms by scanning sites and submit them automatically. A CAPTCHA or a hidden honeypot field stops most of them. If spam keeps coming, check the form isn’t also sending email to the addresses bots type in, which can harm your email reputation.
Sources
- Bad Bot Report 2026: Bots in the agentic age, Imperva, 29 April 2026
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Brute force attacks, WordPress Developer Resources
- Known bot-traffic exclusion, Google Analytics Help
- Verifying Googlebot and other Google crawlers, Google Search Central