Is your website slow because of bots?

A bakery's website is slow one Tuesday morning. By the afternoon it's back to normal. A week later the host sends an email: the account went over its CPU limit. Nothing on the website changed, and the visitor numbers look the same as always.

Often, the visitors nobody counted were bots.

Bots use your server like anyone else

Every request a bot makes is answered by your server, the same as a person loading a page. A person reads a page, then another. A bot can ask for hundreds of pages and files in a few minutes, at any hour, and most visitor counts never show it.

The kinds that do the most work

• Scanners ask for files that hold settings, passwords and backups, like /.env or /backup.sql. They try the same long list on every website they find.
• Password guessing tries one sign-in after another. On WordPress, each try runs the whole sign-in, one of the heavier things a server does.
• Form spam sends your forms over and over. Each one can mean an email sent and a row saved.
• Automated browsers load pages the way a real browser does, with every picture and script, so each visit costs as much as a person's.

Signs it might be happening

• The website is slow at hours when customers aren't around.
• Your host mentions CPU or memory, shows "508 Resource Limit Is Reached", or suggests a bigger plan.
• The server is busier than your visitor numbers explain.

None of this means your website was broken into. It's the background traffic every website on the internet gets. It's usually just invisible.

You can't fix what you can't see.

What it looks like when you can see it

Most rows are grouped: "23 requests, last /.env" is one scanner working through its list. One real visitor sent a contact form in the middle of it, and went straight through.

What helps

Turning a bot away early costs your server far less than answering it. On WordPress, the Rabbitproof plugin has your web server refuse requests for private files before your website does any work, refuses password guessing, and filters form spam before an email is sent.

Bots that only read your pages still reach your server with the plugin. To check every visit before it reaches your server, there's Bot Management.

Most of the time, bots aren't an emergency. They're a cost that's easy to miss. Seeing them is the first step.

RabbitproofBot and spam protection for small websites.