If one country is the clear source of your bot traffic, this is the fastest fix. Go to your Cloudflare Dashboard → Security → WAF → Security Rules, click + Create rule, give it a name like SG Traffic — No Referrer, then click Edit expression and paste:

ip.geoip.country eq "SG" and http.referer eq ""

Set the Action to Block and save. This only blocks Singapore visitors arriving with no referrer — i.e. direct bot traffic. Real users coming from Google or social media will still get through.

Both rules active on techtippr.com — the Bad Bots rule blocked 30 events in 24 hours.

If you want to go more aggressive and block all traffic from that country (bots and real users alike), use:

ip.geoip.country eq "SG"

Only do this if your analytics confirm there are zero legitimate visitors from that country.

Best for: Sites seeing the classic one-country + 404 bot pattern. Quickest way to clean up traffic data before reapplying to Ezoic.

Blocking one country is a bandage. The smarter long-term fix is to block bot behaviour regardless of where it originates. This is the ideal rule for bloggers:

cf.client.bot and not cf.verified_bot_category in {"Search Engine Crawlers"}

This blocks scrapers, AI training bots, and spam crawlers while keeping Google and Bing able to index your site. It’s the “Bad Bots” rule you can see in the screenshot above — and it’s the single most impactful rule you can add.

Name the rule “Bots from Worldwide” and use Edit expression — much faster than using the dropdowns.

For catching suspicious direct traffic from known bad actors anywhere in the world, add a second rule using Cloudflare’s threat scoring:

http.referer eq "" and cf.threat_score gt 10

Cloudflare assigns threat scores (0–100) to IPs based on their history. Above 10 is suspicious. This catches direct traffic from bad actors that Cloudflare’s bot detection may have missed.

Best for: Anyone serious about long-term traffic quality. Pair this with the country rule for maximum coverage.

If you’re not on Cloudflare, or prefer a plugin-based approach, these three free options cover the bases:

IP2Location Country Blocker (recommended) — Install from the WordPress plugin directory. Go to Settings → IP2Location Country Blocker, add your target country, and choose to block with a 403 or redirect. Uses a local GeoIP database, so there are no external API calls on every page load.

WP Cerber Security — Full security plugin with country blocking, bot detection, and protection against repeated 404 hits. Its Traffic Inspector can automatically ban IPs hitting too many missing pages. Particularly useful if your bot problem shows up as repeated 404 hammering.

Wordfence Security — Country blocking is available in the free version under Wordfence → Firewall → Blocking. Also includes rate limiting on 404 errors — useful for exactly this pattern.

Best for: Bloggers not on Cloudflare, or those who want an extra layer on top of Cloudflare rules.

If your WordPress host runs Apache, you can block at the server level with no plugin or Cloudflare required. Add these rules to the top of your .htaccess file in your WordPress root directory.

Block by country (requires mod_geoip):

<IfModule mod_geoip.c>
    GeoIPEnable On
    SetEnvIf GEOIP_COUNTRY_CODE SG BlockCountry
    Deny from env=BlockCountry
</IfModule>

Hard-block AI scrapers by User Agent:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (GPTBot|ClaudeBot|ByteSpider|CCBot|Amazonbot|PetalBot|DataForSeoBot) [NC]
RewriteRule .* - [F,L]

Many AI crawlers ignore robots.txt, but a hard 403 at the server level will stop them. This is one of the most reliable ways to keep AI scrapers off your content entirely.

Best for: Shared Apache hosting where Cloudflare isn’t available. Check with your host first — mod_geoip is not available on most managed WordPress hosts like SiteGround, Kinsta, or WP Engine (which run Nginx).