---
title: "Bad Bots: How to Spot Them and Protect Your Site Without Blocking Google"
description: "**In short**Part of every site’s traffic is not human but automated software. Some of it is useful, like Googlebot indexing your site, and some is harmful: it scrapes content and prices, probes for flaws, guesses passwords and drains your resources.…"
url: "https://www.hyyat.com/en/knowledgebase/block-bad-bots/"
updated: "2026-10-21"
category: Website Security
---

# Bad Bots: How to Spot Them and Protect Your Site Without Blocking Google

**In short**Part of every site’s traffic is not human but automated software. Some of it is useful, like Googlebot indexing your site, and some is harmful: it scrapes content and prices, probes for flaws, guesses passwords and drains your resources. robots.txt does not stop bad bots because they ignore it, so protection belongs on the server or in Cloudflare, taking care not to block search engines.

![Bad bots blocked before reaching the server while a good bot passes](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-bad-bots.webp)

## Good bots and bad bots

  *✓***Useful bots**Googlebot and Bingbot for search engines, and monitoring tools you choose. *!***Content scrapers**Copy your articles, images and prices to other sites. *!***Vulnerability scanners**Try thousands of URLs looking for old plugins and exposed files. *!***Login and spam bots**Guess passwords and fill forms. Read [protecting contact forms](https://www.hyyat.com/en/knowledgebase/protect-contact-form-from-spam/).

## Signs bots are straining your site

- Traffic rises in your stats with no increase in sales or enquiries.
- The site slows down or hits your plan’s resource limits at odd hours.
- Visitor logs in cPanel show many requests from a few addresses or to pages that do not exist.

## How to protect your site

1. **Do not rely on robots.txt alone:** Only good bots respect it. Bad bots ignore it and may even read it to find what you want hidden.
2. **Block abusive addresses:** Use [the cPanel IP blocker](https://www.hyyat.com/en/knowledgebase/block-ip-cpanel/) to block addresses that keep hammering your site.
3. **Block by User-Agent:** Some bots announce their name, so you can block them with an .htaccess rule like the example below.
4. **Turn on Cloudflare protection:** Bot Fight Mode and firewall rules block known bots before they reach your server, and you can switch on [Under Attack mode](https://www.hyyat.com/en/knowledgebase/cloudflare-under-attack-mode/) under pressure.
5. **Rate limit requests:** Especially for search and login pages, which are the heaviest for your site.

```
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTP_USER_AGENT} (MJ12bot|DotBot|PetalBot) [NC]
  RewriteRule .* - [F,L]
</IfModule>
```

 **Do not block search engines:** the real Googlebot comes from Google’s addresses. Some bad bots fake the Googlebot name, so never block that name itself. Before blocking any bot, make sure your SEO tools do not need it.

## How Hyyat Host protects your site

- **Imunify360** detects suspicious automated traffic and challenges or blocks it, while real visitors pass.
- The **CSF** firewall limits large numbers of connections from one address.
- You can connect your site to **Cloudflare** for an extra blocking layer in front of the server.

Learn more about [real-time IP reputation protection](https://www.hyyat.com/en/realtime-ip-reputation/).

## Frequently asked questions

   Does blocking bots hurt SEO?

Only if you block search engine crawlers. Blocking bad bots lightens the load on your site and does not hurt rankings.

   Can I stop content scraping completely?

Not entirely, but blocking and rate limits make it much harder.

   How do I see which bots visit my site?

From the visitor logs or Awstats in cPanel, or from Cloudflare analytics if your site is connected to it.

   **Related guides**

- [How to Protect Your Website Contact Form from Spam and Bots](https://www.hyyat.com/en/knowledgebase/protect-contact-form-from-spam/)
- [Brute Force Attacks: How They Work and How We Protect Your Site](https://www.hyyat.com/en/knowledgebase/brute-force-protection/)
- [What Is a Slowloris DDoS Attack and How to Protect Your Server](https://www.hyyat.com/en/knowledgebase/what-is-a-slowloris-ddos-attack/)
- [The WordPress load-scripts.php Vulnerability (CVE-2018-6389) and How to Protect Your Site](https://www.hyyat.com/en/knowledgebase/wordpress-load-scripts-vulnerability/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)