Just wrapped up a project migrating a client's mid-size ecommerce store off Shopify to self-hosted WooCommerce, age-restricted products so compliance was heavy, on managed hosting with Cloudflare Enterprise through the host. Ran into a solid bot traffic problem during the process and wanted to share what I did, plus ask you all a question since my fix only works because the client is US-only.

The site started getting 503s during traffic spikes. Turned out PHP-FPM workers were getting exhausted from bot traffic hammering the site. Didn't help that the caching plugin the host had installed by default had a broken cookie exclusion rule, so way more pages were loading fresh instead of from cache. That piled onto the bot load, but the bots were the real driver.

What I did about it:

- Ditched the host's default caching plugin, switched to WP Rocket, set up preload and a longer cache lifespan. Fixed the cache bypass issue.
- Geo-blocked all non-US traffic at the edge since the client only ships domestically anyway, with Google and Bing whitelisted so SEO wasn't affected. This alone wiped out most of the international bot traffic.
- Added rate limiting on the busiest pages, again with search engines excluded.
- Blocked xmlrpc.php at the server level instead of using a plugin for it.
- Turned on 2FA for all admin accounts plus a login attempt limiter.
- Switched WP cron to a real server-side scheduled task instead of the default.

Funny side effect, the geo-block also caught PageSpeed Insights and GTmetrix checks since those run from servers outside the US. Sorting out whitelisting for that now.

So here's my question: geo-blocking basically solved this since the client doesn't ship outside the US, but what do you do when that's not an option? If you've worked on a store that ships internationally, how do you deal with bot traffic without being able to just block by region? Behavioral bot management, different rate limiting approach, something else entirely? Also happy to hear if you'd have done anything differently with the above.