From 714064b7c7d19e876d32d6a8e68fc15350828dac Mon Sep 17 00:00:00 2001
From: Charlie Root <root@zamolxis.taild32c88.ts.net>
Date: Mon, 6 Jul 2026 09:44:41 +0200
Subject: [PATCH] feat: rate-limit good bots via object cache, add
 curl/ClaudeBot tiers, whitelist cache warmer

---
 config/badbots.conf                | 4 +---
 config/goodbots.conf               | 4 +++-
 config/whitelist.conf              | 4 ++++
 includes/class-itk-bot-blocker.php | 6 +++---
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/config/badbots.conf b/config/badbots.conf
index 9372179..77a5b11 100644
--- a/config/badbots.conf
+++ b/config/badbots.conf
@@ -10,7 +10,6 @@ firefox/19.0
 firefox/38.0
 firefox/18.0
 wget
-curl
 libwww-perl
 WinHttp
 okhttp
@@ -229,7 +228,6 @@ Xaldon
 Zeus
 ZmEu
 Zyborg
-crawle
 igdeSpyder
 Robot
 Aport
@@ -373,7 +371,7 @@ PolycomVVX
 ^The Knowledge AI
 SputnikBot
 od-database-crawler
-Hype%20Machine
+HypeMachine
 The Hype Machine Engine
 Apache-HttpClient
 Goodzer
diff --git a/config/goodbots.conf b/config/goodbots.conf
index 677310f..bcc0b15 100644
--- a/config/goodbots.conf
+++ b/config/goodbots.conf
@@ -20,4 +20,6 @@ SemrushBot|10
 DotBot|20
 PetalBot|20
 Bytespider|20
-GPTBot|0
+GPTBot|50
+curl|10
+ClaudeBot|50
\ No newline at end of file
diff --git a/config/whitelist.conf b/config/whitelist.conf
index 63ed191..96cd423 100644
--- a/config/whitelist.conf
+++ b/config/whitelist.conf
@@ -12,3 +12,7 @@
 # ua:MyMonitoringTool
 #
 # Lines starting with # are comments. Blank lines are ignored.
+ua:rss-parser
+ua:ZelistBot
+ua:SimplePie
+ua:SI-CacheWarmer
diff --git a/includes/class-itk-bot-blocker.php b/includes/class-itk-bot-blocker.php
index 85bd9e1..453e8c9 100644
--- a/includes/class-itk-bot-blocker.php
+++ b/includes/class-itk-bot-blocker.php
@@ -119,10 +119,10 @@ class ITK_Bot_Blocker {
             return;
         }
 
-        // Sliding window: track hits per bot per minute using transients.
+        // Sliding window: track hits per bot per minute using object cache (no DB writes).
         $window  = (int)(time() / 60); // 1-minute window
         $tk_key  = 'itk_rl_' . md5($name) . '_' . $window;
-        $count   = (int)get_transient($tk_key);
+        $count   = (int)wp_cache_get($tk_key, 'itk_rl');
 
         if ($count >= $limit) {
             // Over the limit – log and send 429.
@@ -147,7 +147,7 @@ class ITK_Bot_Blocker {
         }
 
         // Under the limit – increment counter and allow through.
-        set_transient($tk_key, $count + 1, 120);
+        wp_cache_set($tk_key, $count + 1, 'itk_rl', 120);
     }
 
     /* ── Blocking ─────────────────────────────────────────────── */