VPS bot protection
Bots ate 53% of web traffic in 2025. Stop them from eating yours too
BotStopper separates wanted traffic from unwanted bots, blocking or challenging suspicious requests while letting legitimate visitors through.
Bots now account for around 53% of web traffic. Some are useful, including search engines and services you want accessing your site. Others scrape content, crawl aggressively, or collect your pages for AI training and AI search, consuming resources without necessarily sending visitors back to you.
The problem is that your server still has to deal with those requests. Unwanted bot traffic can consume CPU, PHP workers and bandwidth that could otherwise be serving real visitors.
From £10/month per server. Full pricing ↓
Not sure if it's bots yet? Email support@layershift.com first and we'll check for you, free of charge.
Of 2025 web traffic
BotStopper blocks unwanted bots before they reach your site, so your resources stay available for real visitors.
Who it's for
Built for the site owner watching resource usage climb
For reasons that have nothing to do with real customers:
- Your server load, PHP worker usage or bandwidth is climbing and your traffic numbers don't explain it.
- You've noticed slow page loads or timeouts that trace back to scraper or crawler activity in your logs.
- You want unwanted bot traffic stopped at the door, without touching site code or risking search engine visibility.
Not sure if it's bots?
If your site has started running unusually slowly and you don't know why, you don't need to diagnose it yourself, and you don't need to buy anything to find out.
Email support@layershift.com and our team will investigate the traffic hitting your VPS, free of charge. If bot or scraper traffic turns out to be the cause, we'll tell you and recommend BotStopper. If it isn't, we'll tell you that too, no pressure either way.
Why it matters
Right now, some of the server you're paying for is being spent on bots, not customers
Every request that reaches WordPress or PHP costs something: a process, a database query, a slice of the CPU your VPS makes available. A scraper hitting your site thousands of times an hour spends that budget exactly like a real visitor would, except nothing it does turns into a sale, a signup or a page view that counts. The busier the bot traffic gets, the less of that budget is left for the person who came to buy something.
Adding more server doesn't fix this on its own. Duke University Libraries found that when it tried scaling up resources during periods of heavy bot traffic, the bots consumed the extra capacity too. The fix has to happen before the request reaches your application, not by giving it more to chew through once it's already there.
That's the shape of the problem on an ordinary site too, just at smaller scale: most of what needs stopping was never a sophisticated attacker, it's undifferentiated automated traffic that has no reason to be there and every reason to keep coming back.
- Traffic blocked
- Duke University Libraries piloted the open-source engine BotStopper is built on, across three public applications suffering extended outages from aggressive scraping. It blocked roughly 90% of total traffic, more than 4 million unwanted requests a day.
- Real users
- Stayed unaffected. Across the whole pilot, DUL received 12 reports of a problem in a single week, and of those actually denied access, it was most commonly because they had cookies disabled.
Source: Duke University Libraries, Anubis Pilot Project Report, June 2025.
None of that traffic was there to buy anything. BotStopper stops it before it reaches your application, so the resources it would have consumed stay available for everyone else.
What it actually does
Checks every suspicious request, waves through everyone else
BotStopper gives your VPS protection from bot and scraper traffic, checking every suspicious request before it reaches your site and letting real visitors through without friction.
- Proof-of-work challenge: a visitor's browser solves a small computational puzzle. It's cheap for one real person to do once, too expensive for a scraper to do millions of times over.
- Policy and scoring engine: requests are checked against path, headers and IP range. Unusual signals add to a running suspicion score rather than triggering a blunt allow/deny call.
- DNS-based identity verification: a bot claiming to be Googlebot gets checked against DNS, not just trusted on the strength of a header anyone can type.
- Honeypot maze: hidden links that a real browser never sees, but a raw-HTML scraper will follow. It wastes the scraper's own crawl budget instead of yours.
- Load-aware protection: friction scales up automatically when your server is genuinely under pressure, and stays quiet the rest of the time.
Search engines and other legitimate crawlers that identify themselves accurately are the traffic this is built to wave through. The friction is reserved for what's left after that.
What BotStopper doesn't do: it has one job, keeping unwanted bot traffic from reaching your application at all. It isn't a general security product, and it doesn't try to be. It won't patch a vulnerable plugin or clean up a compromised file; it stops bot and scraper traffic before it gets that far.
Built on the project we sponsor
We don't just run someone else's black-box tool
We sponsor the open-source project behind BotStopper. We went looking for a way to stop aggressive bot traffic from taking over the resources our customers pay for, and found it in Anubis: an actively developed open-source project doing exactly that. Rather than build something from scratch, we became a sponsor and run our own deployment of it.
That means BotStopper runs the same engine, the same challenge mechanism and the same protection as the open-source project it's built on, backed by Layershift support instead of something you'd have to configure yourself.
Pricing
What commercial bot management usually costs
Enterprise bot management is rarely priced for a single server, and it shows in the bill. DataDome's own published Essentials tier starts at $3,830 a month. Real buyer data shows median annual contracts of $76,800 for HUMAN Security (formerly PerimeterX) and $81,450 for Akamai's platform. Cloudflare quotes Bot Management separately at $5,000 to $25,000+ a year on top of a required Enterprise plan.
None of the four publish one clean "bot management" price on its own, and the Akamai and Cloudflare figures reflect broader platform spend, not bot protection in isolation, so treat this as a directional picture of what the category costs rather than a like-for-like quote.
Sources: DataDome's published pricing; HUMAN Security (PerimeterX), Akamai and Cloudflare contract benchmarks reported via Vendr, a third-party SaaS-pricing data service. These are reported figures, not our own measurement.
Even taking the cheapest of the four at face value, DataDome's $3,830 a month, that's still over 380 times what BotStopper costs for the one thing it actually does. Most of that price isn't buying protection from resource-draining bot traffic specifically; it's bundled with account takeover protection, API fraud scoring and credential-stuffing detection you may not need.
Getting BotStopper
Add
Click Add BotStopper and log in to your Layershift account.
Choose your VPS
Pick which server to protect. Running more than one? Pricing is per server, not per account, so add it to each one you want protected.
Protected
BotStopper is applied directly to your server, in front of every site on it.
Still weighing it up? Talk to us first.
Frequently asked questions
Questions, answered
Pick the area you are weighing up, or just scan the lot. Most questions land on how it works, how much control you keep, and pricing.
Will this block Google or other search engines?
Not if it's working correctly. Legitimate crawlers that identify themselves accurately and match their published IP ranges are exactly the traffic the policy engine is built to wave through with little or no friction. The challenge is aimed at unverified and spoofed traffic, a different population from Googlebot's real IP ranges.
Will my real visitors notice anything?
Most won't. Challenges are targeted at requests that look automated or unverified in the first place. A normal browser typically clears the lightest available check in under a second, and a valid pass is remembered for later requests rather than repeated on every page.
Does this slow my site down?
No. The verification step is designed to be cheap on the server side, and protection can scale up or down with your server's own load, so heavier checks only kick in when your site is genuinely under pressure.
Is this the same as blocking bots with robots.txt?
No. A robots.txt rule is a request that an honest crawler chooses to honour, and it performs no verification, so a scraper can claim to be anything it wants at zero cost. BotStopper forces every unverified request to do real work and checks identity claims rather than trusting a header.
What if it blocks a real visitor by mistake?
A valid visitor is very rarely stopped outright. Most see either no challenge or a check that clears in under a second; anyone who does get challenged can simply solve it and continue through to your site, they aren't locked out. If a customer ever reports a problem, that's exactly what support@layershift.com is for.
Do I need to configure anything?
No. BotStopper is added to your VPS and works immediately, with sensible defaults for what counts as suspicious traffic.
Does it replace my other security?
No. BotStopper has one job: stopping unwanted automated traffic before it reaches your application. It runs alongside whatever other security you already have, not instead of it.
Who do I contact if something looks wrong?
Us. BotStopper is an add-on we provide as your host, so anything to do with it goes to Layershift support in the usual way.
I run more than one server. Do I need to buy it multiple times?
Yes. Pricing is per server, at £10 a month each, not a single price across your whole account. Add it to every server you want protected.
What if it's not right for me?
You're covered by Layershift's 30-day money-back guarantee, and you can cancel anytime beyond that.
Is BotStopper open source?
BotStopper is Layershift's own build of Anubis, an open-source bot-protection project we sponsor. It's the same open-source protection engine, run and supported by us rather than something you'd have to deploy and maintain yourself.
Why did Layershift build this instead of buying a generic bot-blocking tool?
We went looking for a way to stop bots consuming the server resources our customers pay for and found the open-source project already doing it well. Sponsoring and deploying it ourselves meant we could offer it as part of your VPS rather than send you to a third party.
Go deeper
Which bots to allow
BotStopper decides which unverified traffic gets challenged. Deciding which named bots deserve a free pass in the first place is a separate question, and one worth getting right: Cloudflare's own "block AI training" toggle blocks Googlebot too, unless you know which of its eleven behaviour categories you're actually turning off.
Ready when you are
If bots are eating into what your server can offer real visitors, the fix takes minutes, not a procurement process.
Not sure yet? Email support@layershift.com first and we'll confirm whether bot traffic is actually the cause before you spend anything. Either way, the next step is yours.