Rate Limiter
Basic Rate Limiting counts page requests per visitor - IP address plus user agent - and slows down anyone who makes too many in a minute. It catches scrapers that pretend to be a normal browser, which the user-agent blocklist can't recognise.
From version 1.0.4 the limit applies to every visitor who is not logged in. In earlier versions it only counted bots that were already on the blocklist, so it never slowed anything down.
How It Works
- Requests from bots on the blocklist are blocked straight away with 403 Forbidden (reason
blocked_user_agent). - Every other request from a visitor who is not logged in is counted in a transient keyed by their IP and user agent. The count expires after 60 seconds.
- Once the count reaches requests per minute (default 60), further requests in that minute get 429 Too Many Requests with a
Retry-After: 60header, and are logged with the reasonrate_limit.
Logged-in users are never rate limited, and pages where protection is turned off with the per-page control are skipped.
60 page requests a minute is far more than a person browsing your site makes, so real visitors aren't affected. If your site uses full-page caching, cached pages are served before WordPress runs and aren't counted.
Settings
Go to Settings → ScraperBlock:
| Setting | Default | Description |
|---|---|---|
| Basic Rate Limiting | On | Turn the limit on or off |
| Requests per minute | 60 | How many page requests one visitor may make in a minute |
IP Detection
ScraperBlock checks these headers in order and uses the first valid IP:
HTTP_CF_CONNECTING_IP(Cloudflare)HTTP_X_FORWARDED_FOR(first IP)REMOTE_ADDR
For rate limits per page type, WooCommerce catalog protection and IP allow and block lists, see ScraperBlock Pro.