01 · The failure mode
The problem is usually not a hacker.
When a client calls us about security, the site has almost never been breached. What has happened is one of these.
The site got slow and nobody knows why
Traffic is up, but not from people. Bot traffic consumes the same server resources a customer does, and modern hosting plans bill by visits, so it arrives as a performance problem and a billing problem at the same time.
Something invisible broke
The front end loads. The forms still render. But the API sync to a CRM, an ATS, a booking system or a payment provider has been failing for hours, because when the server hits its resource ceiling it sheds third-party work first and keeps the public pages alive. Users see a slow site. The business sees stopped operations.
The defense broke the site
Someone turned bot protection up, or enabled aggressive caching, and now legitimate visitors are being challenged, search crawlers are being blocked, or cached pages are serving expired form tokens and every submission fails.
All three are configuration problems. None of them are fixed by another plugin.
02 · What we do
Four pieces of work, in the order they usually happen.
Cloudflare, properly
Configured against your site, not a template
A default Cloudflare install does very little. We deploy it as a defined project with around 18 discrete tasks: DNS migration, SSL and TLS policy, managed and OWASP rulesets, WordPress-specific rules, rate limiting on login and API endpoints, custom rules for malicious and empty user agents, blocked file extensions and XML-RPC, geo policy, cache rules with explicit bypasses, security headers, and a tested false-positive pass so none of it blocks real customers.
Read what the setup includes →Bot control
Blocking that does not cost you search traffic
Turning bot protection to maximum is the wrong lever. We measure the traffic first, identify the specific crawlers consuming the allowance, and block them by name while leaving search engines and the AI assistants that send you referral traffic fully accessible. On one recruitment site, AI crawlers alone accounted for roughly 30,000 visits a month against a plan billed by visit count.
How we handle crawler traffic →Incident response
Something to do when it is actually happening
Rules are the easy part. The hard part is the Tuesday afternoon when the site is under load and the person who has to act is your marketing manager, not your developer. So the work ends with a written runbook and a service level agreement: what counts as critical, who is contacted and how, what response time applies out of hours, and the two or three things your team can do from the dashboard in the first five minutes.
Emergency and DDoS response →Migration
Moving the site, when the host is the problem
Sometimes the honest answer is that the hosting is wrong. Opaque resource limits, autoscaling that turns an attack into a four-figure bill, or a plan sized for traffic that no longer looks anything like it did when it was bought. We migrate with the old environment kept live as a rollback until the new one is proven, and put Cloudflare in front as part of the same piece of work.
WordPress hosting migration →03 · Who this is for
It matters most where the site is not a brochure.
The work applies to any WordPress site. But if your WordPress install talks to another system that the business depends on, the failure mode is much worse than slow.
Recruitment sites are the clearest example: a job board that syncs with an ATS does not degrade gracefully, it stops. Roles cannot be posted and applications cannot be actioned, while the public site keeps serving pages as if nothing is wrong.
Security for recruitment and job board sitesThe same logic applies to membership sites, booking platforms, WooCommerce stores with inventory sync, and anything with a certification or application workflow behind it.
05 · Reference material
Work it out yourself first.
We would rather you understood the problem than took our word for it. These three guides are the reference material behind the work above, written for people who want to diagnose or fix it themselves.
Checklist
Cloudflare WAF rules for WordPress
Every rule a WordPress site should have, in the order to deploy them, plus the two verification steps most guides skip.
Read the checklist →Diagnosis
Your nonce did not verify
The caching failure that silently breaks form submissions for real users while working perfectly when you test it.
Read the explanation →Cost
Why AI crawlers inflate your hosting bill
How to find out what share of your hosting plan is being spent on robots, and what to do about it without losing search traffic.
Read the guide →06 · How we work
Five steps, and you see the scope before anything is touched.
Scoping call
Twenty minutes. We look at what the site actually is, what it connects to, and what has already gone wrong.
Assessment
We measure before we change anything: where the traffic is coming from, what is consuming resources, which integrations are exposed, what the current configuration is doing and not doing.
Written scope
A task-by-task breakdown with time estimates and a fixed price. You see exactly what is being configured before anything is touched.
Implementation and testing
Changes are made in a sequence that lets each one be verified.
RuleWe test for false positives explicitly, because a rule that blocks a real customer is worse than no rule.
Handover
Documentation of every rule applied, a dashboard guide so your team can see what is happening, and the emergency runbook.
Most projects take one to two weeks from approval. Where the site is already under active attack we work to a compressed schedule.
Ongoing monitoring, updates and incident cover is handled separately through our maintenance service.
WordPress maintenanceCommon questions
Is Cloudflare’s free plan enough?+
For a small brochure site, often yes. The free plan gives you DDoS mitigation and basic bot filtering. What it does not give you is rate limiting you can shape, the managed WAF rulesets, detailed firewall analytics, or the granular bot controls you need to block one crawler while allowing another. If the site carries transactions, applications or an API integration, the Pro plan is usually the right call and the licensing cost is small next to the work.
Will blocking bots hurt my SEO?+
It will if you do it bluntly. Raising a global bot protection setting is exactly how sites end up blocking Googlebot. Done properly, blocking is per-crawler and verified: search engine bots stay on the allowlist, the AI assistants that send referral traffic stay accessible, and only the crawlers that take without giving anything back get blocked. We capture a baseline before and after so the effect is measurable rather than assumed.
My site has not been hacked. Do I need this?+
Most of our security clients have never been breached. They came to us because the site was slow, the hosting bill kept growing, or an integration kept dropping. Those are the symptoms that resource exhaustion and bot load produce, and they cost money long before any breach does.
Can you work with my existing host?+
Usually, yes. Cloudflare sits in front of whatever hosting you have. We only recommend migrating when the host itself is the constraint, for example when resource limits are invisible to you, or when autoscaling means an attack becomes an uncapped bill. If we do recommend a move, we say why in writing before you commit to it.
What happens if we are attacked after the work is done?+
You get a written runbook covering the first actions, including how to enable Cloudflare’s Under Attack mode and how to block a specific IP or region from the dashboard, plus a response SLA with defined times for critical and high priority incidents, including out of hours and weekends. We ask clients to rehearse the first step once, so nobody is reading the document for the first time during an incident.
Do you do security audits or penetration testing?+
No. We do configuration, hardening and incident response. If a site needs a formal security audit or a pen test we will say so and point you to someone who does that specifically, rather than sell you an adjacent service.
