Block Bad Bot

Singapore Bot Traffic: Why a Country Block Isn't Enough

Mon, 14 Sep 2026 00:00:00 +0000

Search “Singapore bot traffic” and you’ll land on a Google Analytics community thread that’s become a rite of passage: a site owner watching GA4’s real-time report fill up with hundreds of “users” from Singapore, out of nowhere, and asking the two questions everyone asks next — is this ghost spam, or an actual bot attack, and either way, how do I make it stop?

That distinction matters more than it looks. Ghost spam never touches your site at all — it’s a fake hit fired straight at your GA measurement ID, so your real server or CDN logs show nothing unusual, and no firewall rule will fix it (you need a GA-side hostname filter instead). Real bot traffic actually requests your pages, which means it shows up in your own logs too — and that’s the case a firewall can do something about.

Why a 200 OK Beats a 403 for Blocking Bots

Mon, 14 Sep 2026 00:00:00 +0000

Most WordPress security plugins handle bad bot traffic the same way: detect it, then slam the door with a 403 Forbidden.

That feels like the right move, but it has two problems.

It tells the bot operator they’ve been caught. A 403 is an unambiguous signal — “this fingerprint is blocked.” A scraper running at any scale reacts to that signal: rotate the User-Agent, rotate the IP, try again. The block becomes a game of whack-a-mole instead of a fix.

About

Mon, 01 Jan 0001 00:00:00 +0000

This site is written by techpot, an independent developer working on bot detection and traffic-filtering tools for WordPress.

The starting point was a real six-figure-request bot-traffic investigation on a production site — sorting out which “visitors” were real, which were scrapers spoofing real browsers, and which were search-engine crawlers that just needed to be recognized correctly rather than blocked. That work turned into Lubber, a WordPress plugin that intercepts scraper and residential-proxy bot traffic before WordPress finishes loading.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

For questions about this site or the Lubber plugin, reach out at akuchandrasekar@blockbadbot.com.

Privacy

Mon, 01 Jan 0001 00:00:00 +0000

This site is a static blog. It doesn’t use cookies, doesn’t run analytics, and doesn’t collect or store any personal data from visitors.

If you email the contact address on this site, that email is used only to reply to you — it isn’t shared with anyone else or added to any mailing list.

Terms

Mon, 01 Jan 0001 00:00:00 +0000

The content on this site is provided for informational purposes and reflects the author’s own findings and opinions — it isn’t professional security advice for your specific situation.

You’re welcome to link to any post here. If you want to republish or quote more than a short excerpt elsewhere, ask first via the contact page.