Why are automated bot attacks and hacking attempts suddenly surging?
Sites on platforms like WordPress and Shopify are being overwhelmed by relentless daily bot attacks and scripts like wp2shell that exploit unmaintained pages and checkout links. This constant barrage prevents small business owners from operating normally, forcing them to spend money on services like Cloudflare while leaving them vulnerable to site cloning and identity theft.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1Putting websites behind Cloudflare
- 2Using Wordfence with multi-factor authentication
- 3Migrating websites to static site generators
- 4Forcing customer accounts required for checkout
- 5Setting up custom WAF rules and rate-limiting via Cloudflare
- 6Blocking specific international traffic and suspicious ASNs
- 7Delaying payment capture until items are shipped
- 8Temporarily hiding or disabling out-of-stock products
In their words
Unedited, most upvoted first, each linked to the thread it came from.
“We're getting hit with the same massive bot attacks daily, we even migrated over completely to Cloudflare and are paying their pro plan to stop it as much as possible...”source ↗
“Since yesterday I am having a huge bot traffic in my website. I am honestly a very small business run only by me and although I don’t fear for fraudulent orders (paid before fulfilment) the fear of cloning and identity theft is real.”source ↗
“I’ve been working with Wordpress for years, I got more hacked site the past year than never before… wp2shell is hitting hard and increasing day by day with unmaintained sites…”source ↗
“You are not the only. We are having the same issue with shopify since December last year. We tried many things and nothing works and the reason is bc they work through shopify link checkout page.”source ↗
Where this came up
People with this problem also raised
- 3How to stop excessive bot traffic and AI scrapers
- 5How to clean up a hacked website and fix malware
- 3Why is my website traffic suddenly spiking with no sales?
- 5Why does editing AI website code break other parts of the site?
- 3How to avoid paying $250 a month for routine website maintenance
- 3How to stop an email spam bomb attacking a user inbox