Imunify360 can now throttle AI crawlers instead of forcing a choice between letting them run unchecked and blocking them outright. AI Bot Management, a new feature delivered through the Imunify Security plugin for WordPress, classifies incoming bot traffic, verifies which crawlers are who they claim to be, and rate-limits the expensive ones to a level a server can sustain. It is available now to Imunify360 customers, at no extra cost.

AI crawlers are the new heavy traffic

GPTBot, ClaudeBot, Meta’s crawler, Bytespider, and dozens more now hit content-heavy pages at volume. Each request looks legitimate, and each one triggers a full page render, database queries, and PHP execution. Multiply that across every site on a server and it surfaces the way hosting providers already describe it: slow sites, CPU overages, and “why is my site slow” tickets.

The scale is not a rounding error. Automated traffic is now more than 53% of all web traffic, ahead of humans for the second year running (Imperva/Thales 2026 Bad Bot Report). Resource-eating bots are a top security overhead for 36% of hosting providers, and slow sites drive 29% of customer churn (Web Hosting Trends Report 2026). WooCommerce stores get the worst of it. Kinsta reported a single AI crawler making 3.75 million requests to add-to-cart URLs on one store in a day.

You can’t just block them

Blocking GPTBot or Google’s AI crawler pulls a site out of AI search and answers, which is exactly where site owners now want to show up. So the old firewall reflex, allow or block, is the wrong instrument. Until now Imunify treated bots as a binary decision: a bot was on the allowlist or the blocklist, with no way to say “you can come in, but slow down.” That gap was the most common request we heard from hosting providers at CloudFest 2026.

The middle ground: throttle, don’t block

AI Bot Management sorts every request into one of six categories: verified search engine, verified AI crawler, unverified bot, unknown automated, malicious, and human. It does not trust the User-Agent string, which anyone can spoof. It verifies a crawler’s claimed identity against the IP ranges each operator actually publishes, backed by more than 140 crawler signatures.

Then it applies a limit that fits the category:

  • Verified search engines flow at generous limits, so indexing and rankings are untouched.
  • Verified AI crawlers get a moderate limit and an HTTP 429 with a Retry-After header, the “come back slower” signal well-behaved bots respect.
  • Bots that spoof a known identity, or that hammer from datacenter IPs with no business doing so, get throttled hard or blocked.
  • Known-bad clients, and anything that trips a hidden honeypot link, are blocked outright with an HTTP 403.

Two design choices matter for anyone running this at scale:

  • It runs before WordPress fully loads, so a throttled request never costs a full page render.
  • It fails open: if anything in the bot layer errors, the request passes through normally. It will not take a site down.

Site owners choose from three presets: Balanced, Strict, and Monitor, with no thresholds to tune.

Where it fits in Imunify360

Treat it as the third job of the traffic-management layer that WebShield, Imunify360’s anti-bot and DoS layer, already anchors. That layer now does three distinct things, each with its own response:

  • Block malicious bots.
  • Absorb and challenge DoS floods.
  • Throttle expensive-but-legitimate AI crawlers (new).

The first two deal with attacks. AI Bot Management deals with load that is not malicious at all, only costly, which is why the answer is a limit instead of a block.

Turn it on

AI Bot Management is available now for Imunify360 customers through the Imunify Security plugin for WordPress. A hosting admin enables it server-wide with one command:

imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection": true}}'

It starts on the Balanced preset. To set the server-wide default preset, use one of:

imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection_preset": "balanced"}}'
imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection_preset": "strict"}}'
imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection_preset": "monitor"}}'

From there it shows up in the WordPress dashboard, where each site owner gets an Imunify Security widget: they can see how many bot requests were blocked or limited in the last 24 hours, switch modes, or turn it off for their own site.

The Imunify Security Bot Protection widget in the WordPress dashboard, showing status, requests blocked in the last 24 hours, the active preset, and per-category rate limits.

On ImunifyAV and ImunifyAV+: Monitor mode only. Full AI Bot Management (throttling and blocking) runs on Imunify360. On ImunifyAV and ImunifyAV+, it runs in Monitor mode only: it classifies and reports the AI bot load hitting your sites, without rate-limiting, so you can quantify the load before enabling the full solution on Imunify360.

For setup details and options, see the Imunify Security plugin documentation.

This is just the start for AI bot management

More control and visibility for site owners is coming, and the same throttling will extend to the server level via WebShield, covering every site, not only WordPress.

Turn it on, point it at a site that AI crawlers have been hammering, and watch the load come down while the site keeps showing up in AI search.