Scan or Suffer: The Critical Importance of Weekly Malware Scans

by High Priest | May 8, 2026 | firewall stuff | 0 comments

Featured image showing a WordPress firewall blocking bots and scanners from scraping website content

⚠ BotExorcist Field Notes · SEO Reality Check

WHAT I LEARNT
INSTALLING
BOTEXORCIST.

I have been doing SEO for 12 years.
Then I started watching the logs properly.
And it changed how I look at websites.

↓ read this if your website traffic stopped making sense ↓

It starts immediately. And it never stops.

The thing I could not ignore

I Could Feel
Something Was Wrong.

Before I had the proof in front of me, I could feel something was wrong.

I had been doing SEO for years. I knew what a normal indexing problem looked like. I knew what a redirect problem looked like. I knew what a 404 problem looked like. I knew what bad technical SEO looked like.

But some of what I was seeing did not make sense.

Pages were being deindexed because of redirects.

But there were no redirects on those pages.

404 pages were showing up.

But those pages had never existed.

URL parameters were appearing everywhere. Search Console was getting clogged with junk. Real pages were slow to get crawled. Real pages were slow to get indexed.

It felt like the website was being read through dirty glass.

Search Console was showing symptoms. Something else was creating the disease.

The thought that kept playing in my head

Backlinks.
Dwell Time.

If dwell time can help a page, then poisoned dwell time can hurt a page.

What kept playing in my head was the Google court-case discussion around ranking signals, backlinks, and dwell time.

If positive engagement can help a page, then poor engagement can damage the story around a page.

If people land on a page, stay, read, scroll, click, and engage, that tells a good story.

But if something lands on a page, stays for one second, does nothing, and leaves, that tells the opposite story.

This page did not hold attention.

This content was not useful.

This visitor was not interested.

Now imagine that pattern happening all day.

Arrive. Do nothing. Leave.

That is fake rejection.

And if fake rejection can attach itself to your pages, then your website can start looking weaker than it really is.

That was the thought I could not shake.

If dwell time can lift a page, then poisoned dwell time can drag a page down.

And if that is true, then one-second bot traffic is not harmless.

It is not background noise.

It is not “just bots.”

It is a way of making a good page look like people hated it.

That is when I knew I needed to stop guessing.

I needed to see what was actually hitting the website.

So I got BotExorcist.

If machines create fake rejection, with fake engagement, then your website can be blamed for visitors that were never real people, that never had a real interest, that were only interested in diminishing your pages dwell time. Why? Because of money interests. Either protecting their territory, wanting you to take a service to get noticed...

The logs changed the picture

Then Search Console
Started Making Sense.

Once I started watching the BotExorcist activity logs, the strange things I had been seeing in Google Search Console finally started making sense.

Search Console was showing me symptoms.

BotExorcist showed me the behaviour behind the symptoms.

Search Console showed strange URLs

BotExorcist showed the machines requesting them.

Search Console showed 404s

BotExorcist showed the probes creating them.

Search Console showed parameter spam

BotExorcist showed repeated hits, rotating IPs, and junk query strings behind it.

Search Console showed messy page signals

BotExorcist showed the site was being hammered from the outside.

That was the moment it all clicked.

Google was not inventing the mess.

Google was seeing the mess they created somehow.

The bots were creating the false trails. The delays between dashboard updates was to obscure the data I thought, to sever the connection between bots and what was happening on the screen for plausable deniability.

Google was reporting the false trails and was sending itself on a wild goose chase hunting down 404's that never existed, hunting down 301 redirects that where never there, hunting down fake urls that never existed, while using up crawl budget. Never getting to your own pages until it managed to clean up this mess. But of course, the bots are relentless, they specialise in wild goose chasing breadcrumb trails. They do this all day, across millions of websites. It's not that my website was special, indeed it wasn't.

And so I had been staring at the Google Search Console dashboard not understanding the source of the pollution or why it was there. I thought I was bad at SEO, because I couldn't get out of this muck.

BotExorcist made the invisible visible. BotExorcist gave me an exit strategy, already planned.

The first signal

When Your Website
Gets Noticed.

The moment your website goes live, it does not sit quietly in a corner of the internet waiting for Google and customers.

It starts immediately.

WordPress can ping update services such as Ping-O-Matic. Your sitemap becomes discoverable. Your robots.txt file tells crawlers where the doors are. Your homepage, feeds, posts, categories, tags, assets, and public URLs begin leaving signals that your website exists.

And once that happens, the machines come looking.

Servers come looking at the fresh meat. They read your robots.txt file. They look for your sitemap. They test your public URLs. They follow paths. They request pages. They look for patterns.

And when something looks important, popular, exposed, linked, indexed, or vulnerable, they start hammering it.

That is the part most website owners never see.

Your website gets attention before it gets customers.

The internet sees you before your customers do.

The traffic nobody talks about

Some Useful.
Some Malicious.

Search Crawlers

Useful · Necessary · Must be protected

Not every bot is the enemy.

✓ Verified search crawlers need clean paths.
✓ Good crawlers help discovery and indexing.
⚠ But fake crawlers often pretend to be useful.
⚠ You need to know the difference.

Scrapers

Content theft · Data harvesting · Copying

They want what your site contains.

✕ They copy content, images, pages, prices, and structure.
✕ They harvest data without becoming customers.
⚠ They add traffic load without adding business value.
⚠ They often come back again and again.

Probes

Junk URLs · Exposed files · Weak spots

They test your site before you even know they are there.

✕ They request pages that should not exist.
✕ They look for plugins, themes, login paths, forms, and old files.
⚠ They create fake 404 noise and polluted URL trails.
⚠ They make the evidence around your real pages harder to read.

Paid Traffic Noise

Drive-bys · No signal · Budget waste

A charged arrival is not proof of interest.

✕ One second on site.
✕ No scroll, no click, no dwell, no form action.
⚠ No auditable human interest recorded.
⚠ If you paid for it, it took budget without becoming a customer visit.

Some of it is useful. Some of it is harmless. Some of it is malicious. Some of it is profitable.

The uncomfortable why

Because Traffic
Is Money.

Clicks are money.

Impressions are money.

Leads are money.

Rankings are money.

Attention is money.

Ad spend is money.

Server resources are money.

Data is money.

People ask: why would anyone do this?

Because traffic has economic value.

Some bots are looking for security weaknesses. Some are scraping content. Some are harvesting data. Some are checking forms, login pages, plugins, themes, and exposed files. Some are testing whether your site can be abused.

And some traffic exists inside advertising ecosystems where the click, the impression, the visit, and the volume can matter more than whether the visitor was ever a real customer.

We do not need to accuse anyone by name to understand the incentive structure.

Large online advertising ecosystems benefit when businesses depend on paid visibility. That is not a conspiracy theory. That is the business model of rented attention.

The independence problem

Your Website Making Money
On Its Own.

A business that can earn attention without constantly buying it is harder to tax.

If your website ranks on its own, converts on its own, attracts customers on its own, and makes money from its own organic visibility, then you are less dependent on paid traffic.

That independence matters.

The modern web rewards rented attention. Social reach became pay-to-play. Search visibility became more competitive. Email deliverability became harder. Direct outreach became more restricted. Paid ads became the default tax on attention.

So when bot traffic pollutes your analytics, weakens your engagement story, hammers your server, clouds Search Console, and makes your pages look less effective than they really are, the result is predictable.

You doubt your SEO. You doubt your pages. You doubt your content. You doubt your offer.

And eventually, many businesses do the predictable thing.

They advertise.

If traffic has value, fake traffic has consequences.

The drive-by problem

A Click Is Not
Intent.

A one-second drive-by does not need to buy from you to hurt you.

It only has to arrive.

It uses the server. It creates a session. It affects the numbers. It lowers the engagement story. It adds noise to the page. It makes your data less clean. It makes your SEO decisions less certain.

And if you are paying for that arrival, it also takes your money.

One second. No scroll. No click. No dwell. No form action. No conversion movement. No human signal recorded.

That is not customer intent.

That is a drive-by paid click.

The careful version

Bots can crush the engagement story around your pages, damage signal clarity, and push businesses toward paid advertising.

As my friend Jasper from Texas would say

“They’re crushing your dwell time purposely!”

A charged click is not proof of interest. A one-second drive-by is not a customer visit.

The ranking pressure

Bots Crush The Story
Around Your Website.

Bots do not need to beat your website.

They only need to distort the evidence around it until you start paying for visibility you should have earned organically.

When no-signal traffic keeps hitting your pages, it can crush your dwell-time picture, confuse your analytics, pollute your crawl paths, make your pages look weaker than they are, and make your website harder to understand from the outside.

Whether you call it traffic quality, signal clarity, crawl hygiene, engagement evidence, or SEO protection, the effect is the same.

Bad traffic makes good websites look worse.

And when a business owner believes the website is failing, the next step is usually paid visibility.

That is the trap.

The core idea

Bots Get
A Vote.

They get a vote in your server load.

If automated traffic keeps hitting your site, your server still has to answer. That load is real, even when the visitor is not.

They get a vote in your page speed.

Page speed is not only images, themes, and hosting. Server pressure, junk requests, and bot activity can affect response time too.

They get a vote in your analytics.

If fake sessions, empty visits, one-second drive-bys, and no-signal traffic enter your data, your analytics becomes harder to trust.

They get a vote in your crawl clarity.

When bots create junk paths, strange requests, and polluted trails, the clean map of your site becomes harder to read.

They get a vote in your page clarity inside Google Search Console.

Junk URLs, odd query strings, repeated probes, and strange crawl patterns can create noise around the pages you actually care about.

They get a vote in what Google may think is happening on your website.

Google is not looking at your website in a vacuum. It is crawling, processing, discovering, interpreting, and trying to understand what your website is.

Clean traffic. Clean crawl paths. Clean signals. Clean evidence.

Why this matters for SEO

Security Is Not
Separate From SEO.

Bots do not need to hack your website to damage your SEO environment. They only need to distort the signals around it.

When bots keep hitting junk URLs, fake paths, strange query strings, redirected pages, empty sessions, and no-signal visits, they create noise around your website.

That noise can show up in logs, crawl patterns, server behaviour, analytics, and the way your pages are reported or interpreted.

So the issue is not only security.

It is clarity.

Why BotExorcist exists

Let The Traffic
Reveal Itself.

Observation

First see what is really hitting the site

✓ Watch live traffic behaviour.
✓ Separate real activity from no-signal sessions.
✓ See crawlers, probes, suspicious requests, repeated IPs, ASNs, referrers, and paid-click markers.

Protection

Do not let hostile traffic define the site

✓ Protect real users and verified crawlers.
✓ Block or control hostile patterns.
✓ Reduce junk URL pollution and repeated abuse.

Evidence

Turn suspicion into visible records

✓ Preserve IP, ASN, path, referrer, marker, and session evidence.
✓ Review human signal vs bot behaviour.
✓ Build reports that clients and site owners can understand.

The takeaway

If you cannot see the traffic, you cannot defend the signal.

Not every bot is bad. Not every crawler should be blocked. Not every visit is a visitor. The point is not panic. The point is visibility.

BotExorcist was built because SEO professionals, advertisers, agencies, and site owners need to know the difference between real visitors, verified crawlers, useful traffic, hostile probes, paid-click waste, fake sessions, and visits that arrive with no human signal at all.

In SEO, what you cannot see can still hurt you.

Explore BotExorcist

Important note

BotExorcist helps detect, preserve, classify, and review website traffic evidence. It does not guarantee rankings, indexing, revenue, ad refunds, advertising-platform decisions, or search-engine decisions. Its role is to improve visibility, traffic intelligence, and signal clarity.

The page above explains observed behaviour, incentive structures, and opinion-led interpretation. BotExorcist records evidence; it does not require guessing motive to show whether traffic behaved like a human visitor or a drive-by automated session.