Posts

Lubber is live and installable from the official WordPress Plugin Directory. It’s the plugin that came out of the investigation covered in the last two posts: a Singapore-labeled traffic spike that turned out to be a residential-proxy botnet no IP or country list could ever catch, and the decision to stop returning a 403 to traffic like that so a blocked bot has no signal telling it to adapt. Lubber is that approach, packaged as a normal WordPress plugin instead of a set of one-off mu-plugin files on a single site. ...

Search “Singapore bot traffic” and you’ll land on a Google Analytics community thread that’s become a rite of passage: a site owner watching GA4’s real-time report fill up with hundreds of “users” from Singapore, out of nowhere, and asking the two questions everyone asks next — is this ghost spam, or an actual bot attack, and either way, how do I make it stop? That distinction matters more than it looks. Ghost spam never touches your site at all — it’s a fake hit fired straight at your GA measurement ID, so your real server or CDN logs show nothing unusual, and no firewall rule will fix it (you need a GA-side hostname filter instead). Real bot traffic actually requests your pages, which means it shows up in your own logs too — and that’s the case a firewall can do something about. ...

Most WordPress security plugins handle bad bot traffic the same way: detect it, then slam the door with a 403 Forbidden. That feels like the right move, but it has two problems. It tells the bot operator they’ve been caught. A 403 is an unambiguous signal — “this fingerprint is blocked.” A scraper running at any scale reacts to that signal: rotate the User-Agent, rotate the IP, try again. The block becomes a game of whack-a-mole instead of a fix. ...