mann said
Not only are the bots registering but surprisingly they created around 500 subsites on my site...

It sounds like you're running a WordPress Multisite network. If not, then the hosting account has been seriously compromised.

If so: Do you run any sort of Splog moderation and control, other than captcha on your registration page?

We run a very large WPMS network at Tripawds. I've been fighting spam blog registrations for years and have implemented various methods to bring it under control.

Anti-Splog is the first step.

I also implemented a Signup Code and display that on the reg page, to ensure humans are filling out the form.

Finally, I am working with the developer of Beyond Multisite, who is almost ready to release an update to include Blog Moderation, which allows us to prevent first posts from being published, with an easy way to delete sites and users. No ETA on this, but the beta is working great.

FYI: These methods are in addition to server level csf firewall, and our Wordfence Premium account.

Even with all that, there is still a bunch of stuff that makes it through and attempts dictionary style login attacks.  Those eventually gets taking care of by blocking based on number of failed attempts and such...

I installed it after my site was so badly hacked it took us a month to clean it up. I also lost four months of content.  I've had no trouble, since. It's a lot better to lock the door(s) than to try to get rid of trouble once you've been breached! 

FidoSysop said
I no longer need to enable rocket-loader...I do enable cf auto minify CSS JS and HTML.

And you still disable css/js cache in SimplePress???

Question 1:

You recommend: enable Rocket Loader, especially for the script combining/caching. Great.

You suggest: disable SP combined caching. OK.

But then you suggest: disable Rocket Loader on /forum pages. Uhh...

If we disable Rocket Loader on Forum pages and combined caching is disabled in SP admin, then no CSS or JS is getting minimized and cached. Could you please explain the reasoning here?

Question 2:

Also, when you say "disable Rocket Loader when in SimplePress admin" do you mean literally to turn it off from the CF dashboard whenever visiting the SP admin? Or writing a page rule?

If the latter would that rule look something like this?
...domain.tld/wp-admin/admin.php?page=simple-press/admin/*

Thanks again!

SimplePress is fully compatible with WordPress on standard (old school hosting installations.) However to get the most out of SimplePress here are my best tips for running it under CloudFlare.

It’s important to understand that Steve and Andy have written this plugins code to integrate with WordPress. Numerous hooks and database calls are made to WordPress on top of the standard operating calls. This is why we should tweak our CloudFlare settings to get the most out of SimplePress.

• CloudFlare Rocket Loader adds a ton of speed by combining as many scripts as possible in a single request. It is GREAT! But i recommend disabling Rocket Loader when in SimplePress admin.
• Caching combining scripts is provided by cf. I recommend disabling CSS/JS Combined Caching in sp options > global settings. Double caching can and will cause problems.
• Disabling Rocket Loader on the forum page is beneficial for your users. In your cf dashboard click on page rules. Here we want to define a rule to disable Rocket Loader on your sp forum page. Enter (full path to your WordPress forum page followed by /*. Select disable RocketLoader from the options list, then save the rule.
• Further info on creating custom CloudFlare page rules, including Google AMP toggles is here.

Thanks for the response.  Based on your recommendation, I will take the time to write tutorials for the group. 

Best regards,

mike