Hello, nmble,
Unfortunately, theme-level code cannot filter or block automated bot traffic, as requests hit the server and database resources before the theme or WooCommerce scripts even load.
As your hosting provider suggested, the best and most effective approach here is to configure a Web Application Firewall (WAF) or bot protection directly at your CDN/DNS level (such as Cloudflare WAF). You can set up custom firewall rules or enable Super Bot Fight Mode/Bot Management in Cloudflare to challenge or block automated requests targeting your shop filters and pagination.
Implementing nofollow attributes on filter links generally won’t stop malicious or automated scrapers/bots, as they ignore standard SEO directives and crawl parameterized URLs directly. A WAF rule is the most reliable way to mitigate this resource drain.
Best regards,
8Theme’s Team
