Bottle
Bottle is a bot throttling plugin.
Solid choice
Bottle is a solid plugin choice in 2026, with a few things worth checking first. It runs on 100+ sites and was last updated 1 week ago, and scores 68/100 on our health check.
- Actively developed — last update 1 week ago
- Tested with the latest WordPress (7.1)
- Momentum — downloads up 61.3% vs the previous 30 days
- Small user base (100+ active installs)
- Very few reviews so far
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Bottle stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| bot | >100 |
| firewall | >100 |
| security | >100 |
| throttle | #12 |
Version adoption
Share of active sites per release.
About Bottle
From the official readme · v0.4.3Description
Bottle is a bot throttling plugin. It consists of a set of tools that can be used to reduce server load when excessive bot requests are made to a website.
It works by performing a variety of checks on each HTTP request made to WordPress, and throttling sessions or IPs when thresholds are exceeded. These include:
-
Too many sessions per IP. Since some bots don’t bother with cookies, Bottle sets a JWT session cookie for each request. If a single IP address creates too many new sessions within a given timeframe, it is likely a bot, and will be throttled.
-
Too many requests per session. Bottle calculates a request rate for each session. Bots that exceed that rate will be throttled.
-
Too many requests per IP. Bottle calculates a request rate per IP. For bots that don’t process cookies (and therefore sessions), this can throttle abusive IPs.
-
Too many requests per bot. Bottle calculates a request rate per bot (based on user agent reported). Since malicious bots forge user agents, this should be combined with other throttling mechanisms.
-
Bot verification check. Bottle checks bots such as Google, Bing, Meta, etc. against authoritative lists of IP addresses, when possible. Bottle allows for a higher verified bot rate than non-verified rate with the idea that verified bots are likely better behaved.
-
Overall request rate. Bottle can throttle specific sections of a website that are being abused by bots. (For instance, the courses catalog.) This is useful when a large website is being scraped by a bot network with rotating IPs.
-
Excessive 404s. If bots are scanning a website, or are misconfigured, excessive 404s can be time-consuming for WordPress to process. Bottle can either throttle all 404 requests, or can block 404s for static files (i.e. images) only.
-
Exclusions. Bottle can exclude certain URLs, IP addresses, or infrastructure (such as Stripe and Pingdom) from processing to prevent false positives.
When a client is throttled, Bottle can outright throttle it with a 429 response, or can serve a JavaScript-based cryptographic puzzle. If a client is legitimate, it will automatically compute the puzzle’s solution and submit it to the server for verification. (No user input is required.) After it has proven its human-ness, Bottle will permit that user entry to the site. At the moment, some bots, but not all, will solve these puzzles.
When a throttle condition is reached, Bottle terminates WordPress processing, which substantially reduces server load when under attack. Throttles end automatically at the end of their respective measurement windows.
Bottle is not a firewall and will not block or sanitize malicious attacks. However, since such attacks are typically performed in large quantities, Bottle can be effective at slowing such attacks and reducing server load, keeping the website operational for legitimate users.
Overall, Bottle is a set of tools designed to reduce server load with minimal disruption to real users.
Installation
Install and activate the plugin. It will create a mu-plugin automatically.
Important: We recommend the use of a persistent object cache such as Redis because Bottle uses cache/transients as a method of measuring bot activity. When a persistent object cache is available, Bottle will use its wp_cache_incr method. Otherwise, Bottle will fall back to use get_transient and set_transient functions, which reduces its performance.
After installation, all Bottle settings are initially disabled. Go to Settings -> Bottle Settings and configure the plugin as desired.
We recommend that you enable the “Request Logging Enabled” setting temporarily while configuring Bottle. This will show you a live view of all requests that come into WordPress, including the status of each test Bottle runs on each request. This can help you identify which ones need to be configured or adjusted.
Frequently asked questions
Does proof-of-work actually work?
Yes. It’s a somewhat controversial method, and we cannot claim credit for it; ours is a rather simple implementation inspired by Anubis. Is it ethical to offload the work to your users? We’re not sure. Are there PoW-solving browser extensions that intercept and offload to GPU for faster processing? Sure. Does it stop all bots? Nope. We have found that some bots will solve this. However, at this time, and for the types of traffic we see on our sites, it significantly reduces server load while allowing users access to key sections of websites that would otherwise be blocked.
Does Bottle work with Varnish?
Yes, with proper configuration. We have provided Varnish VCL modifications that allow Varnish to continue caching pages while passing the JWT session cookie back and forth. When a page is cached by Varnish, it will never reach Bottle. This throttle is effective on the backend only. However, when a very large website is being scanned or attacked, and many of the pages are not cached, Bottle can be an effective deterrent without reducing the effectiveness of Varnish caching.
Why did we create Bottle?
We are a web software vendor that hosts many websites and applications for clients. We observed many WordPress sites were being routinely attacked, and these attacks caused slowdowns and outages. Recently, with the uptick in AI bot traffic, sites began experiencing bot network attacks, in which clients rapidly rotate their IP addresses. One traffic pattern we identified was one in which large content sections of a website (such as /courses/*) were being scanned. Another involved dynamically contructed URLs (for instance, the following urls are all the same: /content/a-b-c /content/a-c-b…
Changelog
0.4.3
- Minor performance optimizations
- New feature: Check to make sure mu-plugin is installed and operating correctly
- Enhancement: Minor metrics chart improvements
0.4.2
- Responsive mobile styling improvements
0.4.1
- Minor bug fix
0.4.0
- New feature: Data table pagination
- New feature: Filter throttle data by IP, user agent, path, or throttle action to better explore or diagnose abusive bots
- New feature: Status tab with last 24 hour throttle chart to illustrate trend
- Enhancement: Pulls latest log data from multiple log files, if necessary, so that log data doesn’t blank out at the start of a new day
- Enhancement: Metrics chart improvements
- Enhancement: Admin performance improvements
- Enhancement: Restyled admin and added Help menu
- Enhancement: Attempt to reschedule the cron if it is mistakenly deleted
- Other minor bug fixes
0.3.8
- Updated bots list
- Bug fix and minor enhancements for heatmaps
- Tested WordPress 7.1
0.3.7
- Bug fix for malformed log files (can happen if server runs out of disk space)
- Added more bots and verifications
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Bottle alternatives
All bot plugins →
FAQ
Bottle: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 1, 2026
Is Bottle free?
Yes. Bottle is free to download and use from the official WordPress.org plugin directory.
Is Bottle safe to use in 2026?
Bottle is a solid plugin choice in 2026, with a few things worth checking first. It runs on 100+ sites and was last updated 1 week ago, and scores 68/100 on our health check.
How many websites use Bottle?
Bottle is active on 100+ WordPress websites and has been downloaded 2,224 times since it launched in March 2026. It was downloaded 516 times in the last 30 days.
Does Bottle work with WordPress 7.1?
Yes. The developer has tested Bottle up to WordPress 7.1.2, the latest release. It requires WordPress 6.7 or newer.
What PHP version does Bottle need?
Bottle requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Bottle last updated?
The latest version, 0.4.3, was released on September 23, 2026 (1 week ago).
Who makes Bottle?
Bottle is developed and maintained by benrowland.
What are the best alternatives to Bottle?
The most popular alternatives to Bottle are Chatbot for WordPress by Co… (6K+ installs), Kama SpamBlock (4K+ installs) and No-Bot Registration (2K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
