Spam bots and denial-of-service (DDoS) attacks are more than just nuisances; they can severely impact your website’s performance and your business’s reputation. While providers like Cloudflare, Fastly, and Vercel are known for their robust DDoS protection services, WordPress.com has introduced its own solution: the defensive mode.

What is defensive mode?

Defensive mode on WordPress.com is designed to combat spam and DDoS attacks by leveraging a proof-of-work mechanism. When activated, this mode issues a challenge to the browsers of visitors to your site. Here’s how it works:

• Proof-of-work challenge: When someone visits your site for the first time, they are met with a challenge page. This page contains a unique puzzle that requires minimal computational effort to solve, which is manageable for a legitimate user’s browser but challenging for automated botnet traffic.
• Legitimate access: Once the browser solves the puzzle, the visitor can access your site without further interruptions. This process is quick for real users but effectively deters bots that cannot execute JavaScript to solve the puzzle.
• Edge network: The feature is supported by WordPress.com‘s global edge network, ensuring that the challenge is issued and managed at the network’s edge, reducing the load on your site’s server.

How to activate defensive mode?

This protective measure is seamlessly integrated into WordPress.com‘s platform, but here’s how you can manually enable it if your site is on a Business or Commerce plan:

• Ensure your site is on a Business or Commerce plan, as only these plans allow manual management of defensive mode.
• Navigate to your WordPress [.com] dashboard. Click on the ‘W’ icon in the top left corner to go to your Sites page.
• From the list of your sites, click on the title of the site you want to protect.
• Once on the site’s overview page, click on the “Server Settings” tab.
• Scroll to find the “Defensive mode” section. Here, you can select how long you want the mode to be active – from one hour to seven days. Click “Enable defensive mode” to activate it.
• Once the time you’ve selected elapses, defensive mode will deactivate itself without further intervention.

For those on Free, Personal, or Premium plans, WordPress.com automatically manages defensive mode. If your site faces a significant attack, WordPress [.com] staff might enable this mode proactively to ensure your site remains accessible and secure.

Unlike many hosting services that might charge extra for similar security features or require integration with external providers, WordPress [.com] includes Defensive Mode at no additional cost across all plans, with manual control available on higher-tier plans. This commitment to security helps maintain site integrity, ensuring your content remains accessible to real users while deterring malicious traffic.

In summary, whether you’re managing a small blog or a large e-commerce site, WordPress.com‘s defensive mode provides a straightforward, effective method to safeguard your digital presence against the ever-evolving landscape of cyber threats.