cluelessPHP i doubt the bots are clicking a checkbox that says 'remember me' so it sounds like your fundamental session handling code might need some work. You shouldn't be creating sessions for bots at all -- a bot can swarm your site with hundreds of thousands of requests in a very short period of time. Here is a sample function that can be used to detect bots which is fairly easy to understand. The source:
/**
* Check if the given user agent string is one of a crawler, spider, or bot.
*
* @param string $user_agent
* A user agent string (e.g. Googlebot/2.1 (+http://www.google.com/bot.html))
*
* @return bool
* TRUE if the user agent is a bot, FALSE if not.
*/
function smart_ip_detect_crawler($user_agent) {
// User lowercase string for comparison.
$user_agent = strtolower($_SERVER['HTTP_USER_AGENT']);
// A list of some common words used only for bots and crawlers.
$bot_identifiers = array(
'bot',
'slurp',
'crawler',
'spider',
'curl',
'facebook',
'fetch',
);
// See if one of the identifiers is in the UA string.
foreach ($bot_identifiers as $identifier) {
if (strpos($user_agent, $identifier) !== FALSE) {
return TRUE;
}
}
return FALSE;
}
Ideally your code would avoid creating a session for any bot.