0

I run a small website that averages about 500 hits a day. About once a month I have a day where I see a spike of 5,000 in GA4. When looking closer, the traffic would appear to be a bot using a VPN service as the location changes after about 50-100 hits. This traffic will typically last several hours. Additionally, all of the traffic requests for these hits are to the homepage of the website and the sessions last 7-8 minutes.

I'm running a WordPress site hosted at InMotion, WordFence plugin for security, along with the free version of Cloudflare for proxying and basic firewall protection. However, Cloudflare shows less than 500 "requests" in their traffic logs during the same periods.

First, why does Cloudflare show a different number of hits than GA4? Secondly, is there some configuration I need to do in Cloudflare to eliminate this traffic?

Improve this question
5
  • GA4 is based on Javascript and can use it for thing like Adwords, tracking visitors through your site, and other Google services, but it isn't very good at monitoring your server. To know what's going on you need to look at your own server logs. In short: Use the right tool for the job.
    – KIKO Software
    Commented Nov 25, 2023 at 16:34
  • 1
    Are you sure this is a VPN service - that does not make a lot of sense in context here. For example, how do you know its not a bot making use of compromised accounts? What you have said about sessions are only to the homepage and lasting 7-8 minutes also appears contradictory. To what extent is Cloudflare proxying cancelling out benefits of Wordfence - which as I understand it does quite a bit of blocking based on IP. Are you certain that this traffic is not bypassing Cloudflare?
    – davidgo
    Commented Nov 27, 2023 at 10:17
  • @davidgo you ask very good questions which expose my assumptions. Bypassing Cloudflare and hitting the IP address directly would address the substantial difference in counts. Regarding VPN vs compromised accounts, that would make sense too. While Wordfence does block by IP, it also blocks known malicious requests. I simply made the assumption that everything was going through Cloudflare. I forgot to mention, that I'm also on a shared host, so the IP address could be exposed from other sites no matter what I did on Cloudflare.
    – Trebor
    Commented Nov 27, 2023 at 16:11
  • 1
    Do you know the IP addresses Cloudflare is connecting to your server from? If so you should be able to write some .htaccess rules or even modify Wordpress to reject requests not coming from the Cloudflare IP address. It is almost certain the IP address is exposed from other sites, but it still begs the question - "how did the attackers find the actual IP address associated with the domain name as this mapping is not easy to deduce (unless maybe they had it from before you shifted to Cloudflare?)
    – davidgo
    Commented Nov 27, 2023 at 21:24
  • @davidgo, again great suggestions. Thank you. I'll have to look at modifying my .htaccess file. Thank you again.
    – Trebor
    Commented Nov 28, 2023 at 1:08

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.