We have a part of our app that we have open to the public for SEO. It’s a business directory, of sorts. It helps get traffic and eyeballs on our paid features, but it also sometimes gets the attention of bots and other malicious visitors, spiking our WU usage and costing us money. We’re not a huge app, but we get around 5-7K visitors monthly. When that number spikes to 25-30K, it costs quite a bit of WU, and the bot traffic visits hundreds/thousands of pages, not just a few like a normal user.
Here’s an example from this week, where the past two days has seen bot traffic spike our WU usage:
How can we reduce or block bad bot traffic? It’s almost always from countries we don’t serve and would never serve, anyway, so even just blocking traffic from those countries would be fine.
I’ve already spoken with Bubble about this, and their only solution was “get on an enterprise plan so you can control Cloudflare,” which is such a sorry excuse for not having better security controls. They financially benefit from us getting bad traffic, so I understand that there isn’t much incentive for them to fix this, but it’s a real issue, and I know others are experiencing it, as well.
Does anyone know how we can block traffic from certain countries? Just getting tired of having days where we lose $30-50/day because of bad bot traffic.
hey @samnichols I read through your support request from back in April. I think the support team kept mentioning Enterprise plans because it seemed like you wanted special cloudflare rules applied and that can’t be set in your current plan.
Taking a quick look at your logs, this one WF is responsible for more than half of your total daily WUs. Maybe there’s something here you can optimize.
Otherwise I think reviving your support ticket from April and following up asking the team to look into your app’s regional stats could be a good move.
Honestly, I haven’t seen any recent moves from Bubble regarding WU consumption/pricing or improvements to the plans. The current model feels pretty outdated, especially considering how much the platform has evolved.
You’re gonna have to setup your own reverse proxy to filter requests. I always recommend Cloudflare because they have the most comprehensive bot detection.
Traffic gets filtered through your proxy, and allowed requests get sent to your Bubble app.
The most common issue is you can’t set up a CF reverse proxy to a Bubble app because Bubble app IPs are already proxied through Cloudflare. Hence why normally you’d need Bubble to allow you access to these controls and this means an enterprise plan. Which is fair since Bubble shared cluster IPs are probably on the same Cloudflare zones.
One way to work around this is to move your Bubble app to a subdomain (or different domain if you feeling frisky) and setup your own reverse proxy rules to the public domain.
You then set up routing approved requests to your Bubble app.
I have disabled the workflow action costing the most WU for now, but unfortunately that means we have to remove a feature of our app that has existed in that same way since we launched in 2022, all because of traffic we can’t control and which we’re charged for.
The action simply detects an impression of an element and changes one thing in the DB (updates a number). It’s not a WU-heavy action. The problem is that bots are loading thousands of pages, and there are dozens of these elements per page, so it’s eating up a lot of WU. If it were legitimate traffic, I wouldn’t mind, because that would mean a lot of exposure for us (this is from an SEO-focused part of our app). But obviously I don’t want to pay for this much WU when it’s not legitimate traffic, and Bubble’s Cloudflare isn’t catching it. Much of it appears to be from Singapore, which we don’t (and never will) serve.
I would just love for a way to stop bad traffic that we end up paying for, or at least the ability to adjust security settings when things like this occur. Heck, even if we could opt out of Bubble’s Cloudflare to utilize our own, that would be great, since support informed me that setting up our own CF would be overridden by Bubble’s CF.
It just seems like there should be something more that apps can do for security when they’re being targeted by bots but aren’t making enough money to get on an enterprise plan.
Even since I posted this issue, I’ve had another notification about a WU spike, and I’d love help figuring out what I can do to stop the bad traffic without having to remove actions our app needs.
I have my Bubble app on a subdomain, too. So what you’re saying is to run our top-level domain DNS through Cloudflare, which will catch bad traffic (if we set it up right) before it gets routed to the subdomain?
Our Bubble app runs on an app subdomain, which makes it easier to put a Cloudflare layer in front of the public domain.
With a reverse proxy or Cloudflare Worker, you can apply geo-blocking, rate limiting and bot protection before the request even reaches Bubble and starts consuming WU.
For public apps that get heavily scraped, I think some kind of edge protection is becoming almost essential with the current WU model.
I just logged into Cloudflare and asked their AI how to do it. I gave it a bit of context, and it came back with a really well-structured answer and a pretty detailed step-by-step guide.
