Sample report: what is slowing a store down

A real report we made for an online store whose hosting kept showing "508 Resource Limit Is Reached". It is shortened, and the store's name and addresses are removed; the numbers are real. This is what you get: what is slowing your site down, what to change, and proof that the change will not lock out shoppers or Google.

Get a report for your site

What we looked at

The owner created a read-only access key in Cloudflare, and through it we read 4 weeks of the site's traffic: all 2.7 million requests, 1.2 million of which reached the store's server. We split them by day, hour, who sent them and what the site answered, and checked the security settings. A free report covers the last 7 days. You get a short answer first and the details after it.

The short answer

The report starts with four questions in plain words: is anything hurting the site, is it still happening, what is fine, and what to change. Red means act now, blue means keep an eye on it, green means fine.

• A scraper is eating your serverOne bot took 25 of the 93.5 hours your server worked: 196,000 requests in 4 weeks, 91% of them for pages that do not exist, because it makes up page addresses. It is still running.
• Your hosting plan is too tightOn six days the plan hit its limit and showed 1,237 error pages to shoppers, to Google (59 times) and to Bing. Bots made it worse, but the limit itself is low.
• Google and Bing get inNothing blocks them. Real search crawlers get a normal page 85% of the time; the few refusals are on two technical addresses that do not matter for search.

• One scraper bot: 25.0 h (27%)
• Shoppers, Google and everything else: 68.5 h (73%)

Show the numbers

Part	Hours	Share
One scraper bot	25.0	27%
Shoppers, Google and everything else	68.5	73%

Every bot wave, in one table

Each unusual wave of traffic gets a row: who it was, who it pretended to be, what it did to the site and whether it is still going. This is the shortened table from the store's report.

The fix, ready to paste

For each problem the report gives a ready fix: where to click in Cloudflare, what to paste and what it will change. Whoever manages your Cloudflare can add it in a few minutes, or we do it for you.

The main fix for this store shows the scraper a quick automatic check. Most people pass it without noticing; bots fail it. Real Google, Bing and ad crawlers skip it. The bot is recognized by its browser signature (the user agent: the line every browser and bot sends to say what it is). For whoever manages Cloudflare:

(http.user_agent eq "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
 and not cf.client.bot)

Action: Managed Challenge, not Block. Expected effect: about a quarter less work for the server. A second rule blocks the photo copier and the scanner. not cf.client.bot is the part that lets real search and ad crawlers through.

Blocking addresses would not have worked here: the scraper used more than a hundred thousand of them from almost two thousand networks. Its browser signature was the one thing that stayed the same.

Making sure shoppers and Google are not caught

Before suggesting a rule we check who else it would catch. For this one:

• In two weeks this exact "browser" opened 89,800 pages and 126 images, and not one style or script file. A real browser always loads them.
• 67% of these requests came from the US, while the store sells in one European country. From that country, 30 requests matched in two weeks, at most two visitors a day, and a real person passes the check.
• Google, Bing, Facebook ads and Google Ads crawlers are let through by the rule itself.

The one risk: the scraper changes its browser signature and the rule stops working. That is what the check a week later is for.

What was not bots, and what to do instead

Part of a report is telling you what not to block. In this one:

Error pages per day

Show the numbers

Day	Error pages per day
09-30	6
10-01	2
10-02	0
10-03	0
10-04	5
10-05	1
10-06	0
10-07	1
10-08	4
10-09	1
10-10	3
10-11	2
10-12	9
10-13	22
10-14	135
10-15	405
10-16	3
10-17	2
10-18	2
10-19	276
10-20	188
10-21	159
10-22	19
10-23	101
10-24	2
10-25	4
10-26	4
10-27	4

• The "508 Resource Limit Is Reached" errors are a hosting problem first. The report lists the exact hours and what to ask the hosting company. If the errors continue after the fix, the plan needs an upgrade.
• 15% of all requests (179,000) came from the store's own server: a speed-up module downloading the site's own files through Cloudflare instead of reading them from disk. One server setting fixes it.
• Traffic spikes from a local internet provider were the owner working in the admin panel.

A week later: checking it worked

A week after the fix goes live we run the report again and check three things: the scraper is being stopped, the "508" errors are gone, and almost nobody solves the check, which means only bots are hitting it. See how this played out over several reports in our case studies.

FAQ

Do I get the report as a file?

You get the short answer by email and a spreadsheet with the full tables: days, hours, bot waves, networks and rules.

Do you add the rules for me?

The free report gives you the rules to add yourself. If you prefer, our one-off setup adds them and checks the result a few days later.

What if my report finds nothing?

Then you know your traffic is clean and your settings do not block Google or Bing. That is a useful answer too.