How this differs from strikes
The core strike system responds to confirmed bot evidence. Rate Limiting responds to request volume and traffic shape. A rate-limit event does not automatically add a Bot Guard strike, and clearing strikes does not clear active rate limits.
Quick statistics
The module summarizes requests during the current hour, active rate limits, and pattern detections from the last 24 hours. Reset Statistics clears module statistics; it does not change the main strike table.
Request Frequency Limits
| Setting | What it measures |
|---|---|
| Requests per Minute | Total requests one IP may make in one minute. |
| Requests per Hour | Total requests one IP may make in one hour. |
| Background Admin Requests per Minute | WordPress background requests used by forms, dashboards, and interactive features. |
| Integration Requests per Minute | Requests through WordPress integration and application endpoints. |
| Rapid Request Threshold | How many requests arriving very close together count as a burst. Higher values are more tolerant. |
Suspicious Pattern Thresholds
| Setting | What it means |
|---|---|
| Minimum Page Variety | Expected diversity in requested pages. Lower values permit more repetition; higher values expect more varied browsing. |
| Maximum Integration Request Percentage | Flags traffic when too much of its activity targets integration endpoints rather than ordinary pages. |
| Maximum Background Request Percentage | Flags traffic dominated by WordPress background requests. |
| Act on Suspicious Request Patterns | Applies the selected enforcement action. Leave off initially to observe patterns without restricting visitors. |
Enforcement
| Action | Effect |
|---|---|
| Log Only | Records the event without affecting the visitor. Recommended for initial tuning. |
| Throttle Requests | Slows repeated activity while still allowing some traffic. |
| Add Delays | Inserts a short wait into excessive traffic. |
| Block Completely | Denies further access under the module’s enforcement path. |
Exclude Logged-in Users prevents administrator and member sessions from being rate limited. Email Alerts for Patterns uses configured Email Notification recipients. Show Rate-Limit Events in Activity Logs adds context without changing the main strike count.
Module IP Whitelist
Enter one trusted address per line. This list bypasses Rate Limiting only; it is distinct from the main Bot Guard IP whitelist.
Safe rollout
- Enable with Log Only.
- Exclude logged-in users and known integration servers.
- Observe legitimate peaks for several days.
- Set thresholds above normal maximums.
- Use Test Configuration.
- Move to Throttle or Add Delays, then consider Block Completely only after review.