Hi everyone,

My website has recently been getting hammered by bots making a huge number of requests to admin-ajax.php. This is causing my server's CPU usage to frequently hit 100%.

I've enabled Cloudflare's Bot Fight Mode, which seems to help somewhat, but it hasn't solved the problem.

I also tried creating a Cloudflare custom rule to challenge all requests to admin-ajax.php. However, this breaks the forms on my website because they rely on admin-ajax.php to work properly.

I've also enabled Cloudflare's DDoS protection, but it doesn't seem to make much difference in this case.

I'm wondering what the recommended approach would be here. How can I block or rate-limit these malicious/bot requests to admin-ajax.php while still allowing legitimate AJAX requests from my website to work normally?

Any advice would be greatly appreciated. Thanks!