Yesterday, one of our users contacted us after receiving a warning from their hosting provider about high CPU usage and a possible website suspension if the issue was not resolved.
We checked the hosting statistics and discovered a significant increase in automated traffic. Over the previous few days, the website had received a large number of automated requests:
👉 44,399 requests in a single day from IP addresses identified as being in the United States;
👉 150,513 requests from Amazonbot over the previous 3 days.
At the same time, all known vulnerabilities in our products had already been fixed through updates. However, bots continued to send requests and scan the website.
🤔 This is an important distinction: Fixing a vulnerability and blocking bot traffic are two different things.
Even when a bot cannot exploit a vulnerability, its request still has to be processed by the server. A large number of such requests can consume significant CPU and other hosting resources.
⭐️ How We Solved the Problem
In this case, the website is local and is intended for users from only a few countries.
We used the hosting provider's security settings to:
✅ allow access only from the required countries;
🚫 block access from other regions;
🚫 block Amazonbot;
✅ enable rate limiting with a limit of 30 requests.
These rules are applied at the hosting/server level, meaning unwanted traffic can be blocked or limited before it reaches the website and Joomla.
This significantly reduced the amount of unnecessary traffic reaching the site.
⭐️ What If Your Website Must Be Available Worldwide?
If your website needs to be accessible from all over the world, blocking entire countries is obviously not an option.
First, check whether your hosting provider offers WAF, rate limiting, or other traffic filtering at the server level.
If these features are not available, we recommend using Cloudflare.
The main advantage is that suspicious traffic can be filtered before it reaches your server. Cloudflare can provide rate limiting, CAPTCHA/challenges, bot protection, and other filtering mechanisms.
This is especially important when dealing with large volumes of automated traffic, because the requests are stopped before they consume your server's CPU resources.
⭐️ What About Joomla Security Extensions?
Joomla security extensions such as HTProtect and RSFirewall! are excellent tools and provide valuable protection at the Joomla level.
👉 However, they have an important limitation: they operate inside Joomla.
The request has already reached your server before Joomla can process it and the extension can block it. When dealing with tens or hundreds of thousands of automated requests, we need to stop the traffic earlier: not only block the bot inside Joomla, but prevent the request from reaching the website in the first place.
This is why hosting-level protection, a WAF, rate limiting, or an external reverse proxy such as Cloudflare can be much more effective against large volumes of bot traffic.
⭐️ The goal is simple: don't just block malicious requests inside Joomla — stop unnecessary traffic before it gets there.
