COSTS: CPU — OR YOUR ADMIN ACCOUNT
The login cracker
Thousands of password guesses against wp-login.
Blocks the bad bots.Keeps the good ones.
Most of your traffic isn't human — bots hammer your login, scrape your content, and your host bills you for every request. MalCare identifies bots by their behavior across 400,000+ sites and blocks them, while Google, your APIs, and real visitors pass untouched.
350,000+ BOTS BLOCKED / MO · 400,000+ SITE NETWORK · UP TO −70% SERVER LOAD
Trusted by 400,000+ sites · 120 countries
Bots make up much of your traffic.
Your server serves every one.
Analytics tools filter bots out, so you never see them. Your server can’t — it answers every request, and your host charges for the work.
What your analytics counts
What your server serves
Bots · invisible in analytics · billed by your host
A slower site
Real visitors wait while your server answers bots.
A bigger hosting bill
Hosts charge for resources used, and bots use them.
Lockout emails at night
Bots guess passwords on wp-login.php while you sleep.
Who they are
Six kinds of bot. Six different costs.
Each one bills you differently. All of them are blocked the same way.
COSTS: LOAD, THEN THE PASSWORD
The XML-RPC hammer
Many login attempts carried through a single endpoint.
COSTS: YOUR SEO
The scraper
Copies your content and republishes it.
YOUR CONTENT, YOUR CALL
The AI harvester
Reads your pages as training data. You decide who gets it.
COSTS: HOURS
The comment spammer
Fills the moderation queue faster than you can empty it.
COSTS: NOTHING — UNTIL IT FINDS ONE
The probe
Tries every known vulnerability on every door.
Bots are caught by what they do,
across 400,000+ sites.
One site sees a few requests and can’t tell. MalCare sees the same bot working across the whole network, so it’s identified before it reaches you.
MalCare networkSame timing, same pages, same client — one bot.Identified. Blocked on every site.
Behavior, not a blocklist
Request timing, the pages hit and the client used are compared across sites. They’re hard for a bot to fake.
A new IP doesn’t help
An IP address is one clue, not the identity. Switching addresses leaves the behavior the same.
Blocked before it reaches you
A bot identified anywhere on the network is blocked on your site, often on its first request.
350,000+bots blocked across the network last month
18B+requests processed every month
400,000+sites whose traffic trains the detection
Figures as of July 2026
Precision
Good bots and real visitors always get through.
Blocking Googlebot would cost you more than the bad bots do — so good bots are verified, never guessed. Google, Facebook, Feedly and more pass automatically, and real visitors never see a captcha.
- 5.1Search staysGoogle and Bing crawl normally.
- 5.2Integrations keep workingAPIs, payment webhooks, and monitors are allowed.
- 5.3No captchasThe checking does not interrupt real visitors.
Fewer bots, a faster site.
Up to 70% less server load.
Sites moving to MalCare have cut server load by up to 70%. It’s the only security plugin that makes your site faster.
Faster pages
Visitors stop waiting behind bots for the server’s attention.
A smaller hosting bill
On metered hosting, less load means paying for less.
Room to grow
Capacity the bots were using goes back to your customers.
Bot protection that runs itself. You never touch a blocklist.
Blocking bots by hand means chasing IP addresses that keep changing. MalCare’s network does that work, so you don’t.
- No IP blocklists to keep
- No access logs to read
- No rules to tune
- Manual controls if you want them — geoblocking and IP rules
In their words. Bot attacks they stopped worrying about.
Rated 5 out of 5
Best login protection ever! We handle hundreds of sites, and I'd heard bad stories about brute force attacks & password hacking… but thankfully we never had to worry about this because of MalCare. I'm sure this saved us from many sleepless nights!
Robert AbelaWP Activity LogRated 5 out of 5
I was on the beach with my family when MalCare notified me of a plugin vulnerability across 50 of my sites. With one click on my smartphone, all sites were fixed within minutes.
Paul LaceyWordPress ExpertRated 5 out of 5
I had been running iThemes, WordFence & Sucuri, but they kept getting hacked. Then I installed MalCare, which quickly found the malware and cleaned up the entire site.
Adam SilverConciergeWP · FounderBot protection questions, answered.
No. Not blocking good bots is the main design goal. Google, Bing, social preview bots and feed readers are verified and let through automatically.
No. Payment webhooks, integrations and uptime monitors are recognized and allowed. If you run something unusual, you can allow it yourself from the dashboard.
No. Real visitors browse normally. Bots are identified by their behavior on MalCare's side, not by asking your customers to prove they're human.
The firewall looks at what a single request is trying to do, such as carry an attack. Bot protection deals with who is sending requests and how many. They solve different problems, and you want both.
Bots use CPU and bandwidth your host charges for. Sites moving to MalCare have cut server load by up to 70%, which means faster pages and, on metered hosting, a smaller bill.
They're identified by their behavior, like any other bot. Whether your content is used to train someone's AI model is your decision, not a default.
Yes. Geoblocking and manual IP rules are in your dashboard. Most sites never need them.
No. There are no lists to keep, logs to read or rules to tune. The network identifies the bots for you.
Block bad bots without blocking Google.
MalCare identifies bots across 400,000+ sites and blocks them automatically. Good bots, integrations and real visitors get through, and your site gets lighter.
400,000+ SITE NETWORK / GOOD BOTS PASS / NOTHING TO MAINTAIN