At UpTime Web Hosting, we take a protective approach to server performance and security. By default, our managed WordPress hosting stacks use active defence measures to identify and throttle aggressive web scrapers, automated brute-force tools, and malicious bots before they consume your site’s CPU and memory.
Removing rate limiting or disabling security plugins like Wordfence opens your site to unthrottled scrapers and automated attacks. This often leads to severe site slowdowns, high server resource usage (hitting LVE limits), and unexpected 503 errors for legitimate human visitors.
Why Automated Bot Protection Is Crucial
Bad bots and rogue AI crawlers account for over 40% of all internet traffic. Unlike standard visitors who view one page at a time, aggressive scrapers send hundreds of requests per minute to extract content, scan for vulnerabilities, or hoard inventory.
- Protects LVE Resource Limits: Prevents rogue crawlers from spiking your PHP workers, CPU, and RAM limits.
- Ensures Site Speed for Real Users: Guarantees that genuine customers don't suffer slow page loads caused by background scraper traffic.
- Defends Against Brute-Force Attacks: Automatically restricts repeated failed login attempts on
wp-login.phpandxmlrpc.php.
How to Configure Rate Limiting in Wordfence (Recommended)
If you or your development team are encountering false positives while working on your site, do not disable Wordfence completely. Instead, adjust the granular Rate Limiting rules to raise the thresholds while keeping your core defences active.
Step 1: Access Rate Limiting Settings
- Log into your WordPress Dashboard.
- In the left-hand sidebar, navigate to Wordfence > Firewall.
- Click on the All Firewall Options tab at the top of the page.
- Scroll down to find the Rate Limiting Rules section and ensure Enable Rate Limiting is set to ON.
Step 2: Calibrate Recommended Thresholds
Adjust the individual throttle settings to match your site’s typical traffic patterns without leaving it completely exposed:
- How should we treat Google's crawlers? Verified Google crawlers will not be rate-limited.
- If anyone's requests exceed: Set to
1900 per minute(Throttle it). - If a crawler's requests exceed: Set to
240 per minute(Throttle it). - If a human's requests exceed: Set to
120 per minute(Throttle it). - If a human's 404s exceed: Set to
60 per minute(Throttle it). - How long is an IP address blocked when it breaks a rule: Set to
30 minutesor1 hour.
Safely Allowing Developer IPs (Whitelisting)
If your developers, external API connectors, or third-party webhooks are triggering security alerts during updates or migrations, whitelist their specific IP address instead of lowering site-wide security thresholds:
- Go to Wordfence > Firewall > All Firewall Options.
- Locate Advanced Firewall Options.
- Find the Whitelisted IP addresses that bypass all rules field.
- Enter the specific IP addresses (comma-separated or one per line) and click Save Changes in the top-right corner.
