Kinsta has launched Bot Protection for WordPress sites through its MyKinsta dashboard. The feature is included at no extra cost across all customer plans.
The tool lets site owners and agencies manage automated traffic directly from the dashboard, including AI crawlers, suspicious visitors, and other bots hitting WordPress environments. Controls work at the environment level and do not require a support request or a separate product.
The launch comes as bot traffic accounts for a growing share of internet activity and creates problems for WordPress operators, particularly on pages that cannot be cached. Kinsta said more than half of all web traffic now comes from bots, while AI crawler activity rose 300% over the past year.
Its data points to heavy pressure on eCommerce and search-related pages. Bots hit add-to-cart URLs 7.67 million times in a single 24-hour period, while one crawler generated 550 million requests over 30 days, according to the company.
Those requests matter because dynamic pages such as cart pages, filtered product listings, and search URLs consume server resources every time they load. Automated visits can also distort traffic and conversion data when mixed with human traffic in analytics reports.
Dashboard controls
Within MyKinsta, customers can choose from four preset protection levels for each environment: Block Malicious Traffic, Block Automations, Challenge Bots, and Challenge Everyone. The system also includes a managed allow list covering common WordPress paths, WooCommerce routes, and other trusted traffic, with custom exceptions by IP address, user agent, or request path.
Users can also enable a setting to block AI crawlers for sites that want to prevent AI indexing. CAPTCHA checks are based on Cloudflare bot scores, while verified search engine bots such as Google are allowed through.
Kinsta also included an emergency lockdown mode. The Challenge Everyone setting is intended to keep a site accessible to human visitors during an active attack by forcing checks on all incoming traffic.
An analytics tab breaks traffic into categories including verified bots, AI crawlers, automated traffic, and likely humans. That gives operators a clearer view of what is reaching their sites and what is being blocked.
Resource strain
The wider issue for hosting groups and site operators is that not all automated traffic can be treated the same way. Search engine crawlers, plugin-related automations, and other legitimate services often need access, while malicious scraping, aggressive AI indexing, and repeated hits on expensive pages can raise costs and affect performance.
Daniel Pataki, Chief Technology Officer at Kinsta, outlined that balance in comments accompanying the launch.
"Most bot management advice boils down to 'block everything' or 'leave it alone'. Neither works at scale," said Daniel Pataki, Chief Technology Officer at Kinsta.
"Block too aggressively and you hurt your search visibility. Do nothing, and bots are consuming server resources on endpoints that will never convert. We built Bot Protection so site owners can make that call themselves at the environment level, without needing an engineer to do it. We handle the safe traffic automatically, so your plugins and automations keep working no matter what protection level you're running," Pataki said.
The launch also reflects rising concern over AI crawler traffic among publishers, eCommerce operators, and website owners more broadly. As AI companies gather web content for model training and search tools, site operators have been looking for more direct ways to decide which automated systems can access their content and infrastructure.
For WordPress users, that concern is tied not only to content use but also to infrastructure costs. Automated traffic aimed at resource-heavy endpoints can increase hosting loads even when the requests do not produce sales, leads, or meaningful engagement.
Roger Williams, Community Manager at Kinsta, said customers had seen a gap between headline traffic figures and underlying infrastructure costs.
"Customers are telling us that their analytics look fine, but their server costs keep climbing," said Roger Williams, Community Manager at Kinsta.
"Bot traffic was driving it, and they had no good way to act without calling support or paying for another tool. Bot Protection puts that control directly in MyKinsta," Williams said.
Kinsta said it supports more than 230,000 customers across 128 countries and added more than 65,000 new sites in 2025.