Hello wpForo team,

I run the forum at https://www.paradigmshift.com.pk/community-forum/ and need help with server load caused by two kinds of forum URLs.

The problem
Bots and crawlers repeatedly request URLs containing ?foro=allread and filter= query strings. My server's PHP slow log shows each of these requests taking 15–30 seconds of PHP execution (up to 30.5 s), across many URL variants. Because they're dynamic and uncacheable, they tie up PHP-FPM workers and have caused repeated CPU spikes to around 200%, at times making the site inaccessible.

What I've ruled out
- The forum's own pages are excluded from my page cache (FlyingPress), and wpForo's cache is enabled.
- My hosting provider (Cloudways, Lightning/NGINX stack, managed Cloudflare Enterprise) can't add custom WAF rules for specific query strings or user agents, so I can't block this at the edge.
- Most of the traffic comes from automated user agents (curl, python and fake Googlebot), not from real members.

My questions
1. Why are foro=allread and filter= requests so expensive, and can they be made lighter (for example through caching, query optimisation or a setting)?
2. Can these actions be disabled or restricted for guests and non-logged-in visitors, so only members can trigger "mark all read" and filtering?
3. Can wpForo add rel="nofollow" to these links, and/or noindex to the resulting pages, so search engines and crawlers don't follow them?
4. Is there a recommended way, such as a hook or filter, to reject these requests early for bots before wpForo does the heavy work?

Environment
- WordPress with wpForo on Cloudways (2 vCPU / 4 GB RAM, PHP-FPM, NGINX-only Lightning stack)
- Object Cache Pro (Redis), ElasticPress, FlyingPress and Shield Security
- Cloudflare Enterprise in front of the site

I can share slow-log excerpts or example URLs if that would help.

Thank you,
Sarmad
Paradigm Shift (paradigmshift.com.pk)