Bottle vs Traffic Monitor

Bottle is a bot throttling plugin. It consists of a set of tools that can be used to reduce server load when excessive bot requests are made to a website. It works by performing a variety of checks on each HTTP request made to WordPress, and throttling sessions or IPs when thresholds are exceeded. These include: Too many sessions per IP. Since some bots don’t bother with cookies, Bottle sets a JWT session cookie for each request. If a single IP address creates too many new sessions within a given timeframe, it is likely a bot, and will be throttled. Too many requests per session. Bottle calculates a request rate for each session. Bots that exceed that rate will be throttled. Too many requests per IP. Bottle calculates a request rate per IP. For bots that don’t process cookies (and therefore sessions), this can throttle abusive IPs. Too many requests per bot. Bottle calculates a request rate per bot (based on user agent reported). Since malicious bots forge user agents, this should be combined with other throttling mechanisms. Bot verification check. Bottle checks bots such as Google, Bing, Meta, etc. against authoritative lists of IP addresses, when possible. Bottle allows for a higher verified bot rate than non-verified rate with the idea that verified bots are likely better behaved. Overall request rate. Bottle can throttle specific sections of a website that are being abused by bots. (For instance, the courses catalog.) This is useful when a large website is being scraped by a bot network with rotating IPs. Excessive 404s. If bots are scanning a website, or are misconfigured, excessive 404s can be time-consuming for WordPress to process. Bottle can either throttle all 404 requests, or can block 404s for static files (i.e. images) only. Exclusions. Bottle can exclude certain URLs, IP addresses, or infrastructure (such as Stripe and Pingdom) from processing to prevent false positives. When a client is throttled, Bottle can outright throttle it with a 429 response, or can serve a JavaScript-based cryptographic puzzle. If a client is legitimate, it will automatically compute the puzzle’s solution and submit it to the server for verification. (No user input is required.) After it has proven its human-ness, Bottle will permit that user entry to the site. At the moment, some bots, but not all, will solve these puzzles. When a throttle condition is reached, Bottle terminates WordPress processing, which substantially reduces server load when under attack. Throttles end automatically at the end of their respective measurement windows. Bottle is not a firewall and will not block or sanitize malicious attacks. However, since such attacks are typically performed in large quantities, Bottle can be effective at slowing such attacks and reducing server load, keeping the website operational for legitimate users. Overall, Bottle is a set of tools designed to reduce server load with minimal disruption to real users.

Traffic Monitor gives you full visibility into how people and bots are hitting your site. Unlike bloated analytics and security plugins, Traffic Monitor focuses on logging raw request data that you control. You’ll know which pages are cached, which bots are visiting, where users are coming from, and how many requests are tied to each IP/browser combination. Perfect for developers, marketers, and site owners who want fast insights—without handing over their traffic data. What Makes It Different ✅ Logs requests for both cached and non-cached pages ✅ Lets you export raw traffic logs as raw CSV for your own analysis ✅ Identifies repeat ad clicks for spotting potential click fraud ✅ Reveals which bots are hitting your site, so you can block them elsewhere (example: Cloudflare) ✅ Tracks IP address, fingerprint, device type, cache status, response code, and more ✅ Displays referrer URLs and query strings ✅ Records the original source of requests by the same visitor as they surf your website ✅ Doesn’t auto-block or inject junk—just clean, useful data ✅ Works great with Cloudflare, caching plugins, and reverse proxies Key Features Logs every page request, including IP address, referrer, user-agent, browser, device, method, and more. Detects cached traffic even if served by Cloudflare, your web host, or a plugin. Identifies bot traffic by bot name and category. View click IDs like gclid and fbclid from ad platforms like Google and Meta. Records repeat ad clicks to detect potential click fraud. Bulk delete or export logs with one click. Search, sort, and drill into data from your dashboard. Built-in help tabs with definitions, setup help, and troubleshooting. Use Cases Debug integrations instantly: Know exactly what URLs are being hit, by which devices, and with what parameters. No guesswork. Spot caching gaps: See which pages are served from cache and which aren’t, even with Cloudflare or plugin-level caching. Understand real-world traffic: Track entry pages, referrers, devices, and browsers—whether human or bot. Catch click fraud signals: Identify repeat ad clicks tied to the same IP/user agent fingerprint or session, even if served from cache. Audit referrers: View exactly which websites or campaigns are driving traffic (including query strings). Filter out noise: Use bot labels and device types to focus only on human traffic when analyzing patterns.