Bot protection on Cloudways by Malcare — Test driving

It works, but sometimes a little too well.

There are good bots and bad bots. The bad ones wreak havoc on your website.

Cloudways, a platform for managing sites hosted on cloud platforms, recently added Malcare’s bot protection to its service. It promises to block malicious traffic, protect your website from attacks, and reduce server resource usage.

I turned it on to see if it delivered. In short: yes, it blocks a lot of bad stuff, but it also throws the baby out with the bathwater if left unattended.

For example, it blocked the Stitcher podcast service from accessing my podcast feed. It also blocked a lot of public relations services, such as Meltwater, from accessing the site. Services like Meltwater ensure that what I write is read by more people.

On the other hand, it helpfully blocked Ahref’s deluge of bot attempts. I can’t see any benefit of Ahrefs to site owners; it only seems to help other people with their SEO.

Bot protection allows you to whitelist IP addresses and bots that it decides to block, but I’d prefer to work on a blacklist basis instead. In other words, show me a list of bots and I’ll select which ones to block. It would also be nice to block access by known IP addresses to specific resources, such as XMLRPC, which is frequently abused.

I also found that Cloudways had trouble loading detailed data regarding bot attempts. It took a number of days of checking the dashboard to get it to actually load the data. Even then, it worked only part of the time.

One helpful feature of bot protection is that it also blocks WordPress login attempts. As stated by the dashboard, it’s blocking regarding 2,000 invalid login attempts every day.

The net-net is that bot protection on Cloudways is useful but a blunt tool. You need to work with it to make sure it doesn’t block helpful bots from reaching your website.