Bots Crashing a Store Through Its Product Filter

The problem

• The site was crashing repeatedly and the hosting CPU allowance was exhausted.
• Traffic looked high, which made it easy to mistake an attack for success.
• The target was the product filter: faceted URLs generate near-infinite combinations, each one an uncached database query.
• Any fix had to keep genuine shoppers and search engine crawlers getting through.

How we found the cause

• Read the SiteGround and site logs together to separate customer traffic from automated traffic.
• Confirmed the product filter endpoints were the target: every filter combination was a new URL, and every new URL an uncached database query.

The fix

• Moved the site behind Cloudflare so requests could be judged before they reached the origin at all.
• Wrote rules aimed specifically at the filter parameters rather than the site as a whole: blunt site-wide blocking would have caught real shoppers.
• Tuned the rules against live traffic so legitimate browsing and search crawlers continued through untouched.

The result

• Site stable within hours.
• CPU use fell to around 10%, from exhausting the plan’s allowance.
• Memory use dropped correspondingly: the load had been almost entirely automated.
• Same hosting plan, no upgrade required. The capacity was always there; it was being spent on bots.

What this means for you

High traffic and a crashing site do not always mean you have outgrown your hosting. On this store nearly all the load was automated, and it stayed on the same plan once the bots were filtered. Before paying for an upgrade, find out who the traffic actually is.

Product filters are an easy target because each combination of filters is a fresh page the server has to build from the database. Rules aimed at the filter parameters stop that without touching the rest of the site.

Blocking has a cost when it is too broad. Shoppers and search engine crawlers had to keep getting through, which is why the rules were tuned against live traffic rather than set once and left.