Most of the stores we host are the size you’d picture. This one isn’t. It’s a high-traffic online retailer that takes more than 100 million requests a month (every page, picture, or file that a visitor or a bot asks for counts as one request) — and the vast majority of that is not people. It’s automated bots, many of them copying the store’s content, pounding the store around the clock. This is the story of keeping a store that big fast, online, and on a flat price, told without naming it — because a store under this kind of constant pressure doesn’t need the attention that a name in a case study would invite.
The ask: “keep it fast and keep it flat”
The store didn’t come to us looking for a science project. It came looking for two things that are surprisingly hard to get together at scale: a store that stays fast and available under relentless load, and a hosting bill that doesn’t punish it for being popular. It had good reason to worry about the second one. A store this size, on a host that meters traffic, is exactly the kind of account that gets billed into the ground — because most of the “traffic” a metered plan would count and charge for isn’t customers at all. It’s bots.
So the brief was blunt. Absorb the load without passing it back as a surprise on the invoice. Keep the storefront quick for the real shoppers. And do it at a price the store could actually plan around.
What we found: the traffic isn’t shoppers
When we looked at what was actually hitting the store, the shape of it was stark. Out of those 100-million-plus monthly requests, only a small slice was real people trying to buy something. The overwhelming majority was automated: bots copying the catalog, bots probing for weaknesses, crawlers hammering the site for reasons that had nothing to do with the store’s business and provided it no value whatsoever.
That’s the trap a big store walks into without realizing it. Every one of those automated requests is work someone’s infrastructure has to do. If it reaches the store’s own server — the actual computer running the store — it competes with real customers for the same resources, slowing checkout for the people who matter. And on a metered host, that same junk traffic gets counted against a visit allowance and billed, so the store would be paying, month after month, for bot traffic it never asked for and got nothing from. A busy month of bots would read on the invoice exactly like a busy month of sales.
What we did
The whole strategy comes down to a simple principle: the best request is the one your store never has to handle. Around that, we did the steady, hands-on work a busy store needs every week:
- Kept the attacks out. We blocked more than 1.8 million attack attempts between late August and the end of September. We turned away scraping bots running from data-center networks, shut out AI bots that copy content and fake search-engine bots, and slowed down bot floods on the store’s search pages without touching cart or checkout. Real shoppers and genuine search engines get through as normal.
- Closed security holes quickly. We applied more than 50 plugin updates plus a WordPress update, including urgent fixes for serious holes in the store’s subscription and email-marketing add-ons, and checked the store before and after each one.
- Guarded the logins. When someone signed in with a password already exposed in a data breach, that account had to set a new password, and the login couldn’t change the account’s email or password. Outsiders can no longer look up the store’s login names.
- Kept checkout working. We fixed a glitch that could create a duplicate order if a shopper double-clicked or refreshed after paying, made sure the store’s phone app and stock sync keep their access when other plugins change, and retuned the store’s server for new hardware without any downtime.
- Cleaned up and locked down. We repaired product pictures that weren’t showing in some browsers, removed old data files that had been left where the public could download them, moved paid downloads to where only buyers can reach them, set up regular virus scanning of uploaded files, and locked the uploads folder so no program can run from it.
- Backed it up and watched it. The store is backed up off-site 3 times a day, and we check each backup. Over the past seven weeks it stayed online 99.85% of the time.
Blocked the junk out front, before it lands
This store sits behind a fast global network, and for a store at this scale that front line is the entire game. The vast majority of that bot traffic is identified and stopped out front — at data centers around the world, before it ever touches the store’s server. The store’s own server never sees it, never spends any effort on it, never slows down for it. AI bots that copy content, which increasingly make up a large chunk of what looks like “traffic” but is nothing of the sort, are filtered out as a matter of course. What reaches the store is dramatically closer to the traffic that actually matters: real shoppers.
Kept the real shoppers fast
With the junk peeled off out front, the store’s server gets to spend its resources on the people trying to buy. The same global network that blocks the bad traffic serves ready-made copies of pages from data centers close to real visitors, so a spike in genuine demand is spread across a huge worldwide network instead of hammering one server. Paired with the speed tuning we run on the plan, a busy day for real customers is handled quietly. The reasons a store slows down, and how we keep this one quick, are the same ones we walk through in why your WooCommerce store is slow.
Held the price flat
And here’s the part the store cared about most: none of that load shows up as a traffic bill. We don’t meter traffic, at any size. A brand-new store starts on our $39.99-a-month shared WooCommerce plan; a store operating at this scale isn’t on that entry tier at all — it’s on a Dedicated/Custom plan sized to it. What doesn’t change as you move up the ladder is the approach: the price is flat and the traffic is unmetered. Whatever tier a store sits on, it stays that number whether it takes a million requests or a hundred million, whether a month is quiet or record-breaking. There’s no visit allowance to blow through, no overage line item, and no bill that arrives after the traffic. A metered host would have turned this store’s bot problem into a billing problem on top of a performance one; we treat absorbing the load as part of doing the job, not as a meter ticking in the background. That’s the whole approach, laid out in unmetered WordPress hosting explained.
What’s happened since
The store keeps taking its 100-million-plus requests a month, and the vast majority of them keep getting stopped out front, quietly, before they ever reach it. The storefront stays fast for the customers who are actually there to buy. And the invoice stays exactly where it started — a flat, predictable number that doesn’t flinch when the bots have a busy month.
The store spends its attention on selling, not on watching a traffic counter or bracing for an overage. The load that used to be a threat on two fronts — performance and cost — is simply handled on both.
The point of the story
Flat, care-included hosting isn’t a small-site thing you outgrow. This store is proof of the opposite: the model holds at serious scale, because the smart way to handle enormous, mostly-automated load is to block it out front rather than pay to process it. A store taking north of 100 million requests a month runs on the same flat, unmetered approach as a brochure site taking a few thousand — a plan sized to what you run, not a meter, with no ceiling on the traffic it absorbs. The entry price is $29.99 for a managed site or $39.99 for a store; a store at this scale sits at the top of the ladder on a Dedicated/Custom plan. You don’t outgrow it; you grow into it.
If you run a large, high-traffic store and you’re either watching a meter or dreading the day you cross it, that’s exactly the problem this is built for. Have a look at our managed WordPress and WooCommerce plans, and let’s talk about what your store’s traffic really is — and how much of it you should never have to pay to handle.