Why are automated bot attacks and hacking attempts suddenly surging?
Sites on platforms like WordPress and Shopify are being overwhelmed by relentless daily bot attacks and scripts like wp2shell that exploit unmaintained pages and checkout links. This constant barrage prevents small business owners from operating normally, forcing them to spend money on services like Cloudflare while leaving them vulnerable to site cloning and identity theft.
What the numbers show
Counted from the threads quoted below. How we count
- The most recent one is from August 2026.
- This comes up 106.2× more often in r/shopify than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Putting websites behind CloudflareDid this help you?
- 2Using Wordfence with multi-factor authenticationDid this help you?
- 3Migrating websites to static site generatorsDid this help you?
- 4Forcing customer accounts required for checkoutDid this help you?
- 5Setting up custom WAF rules and rate-limiting via CloudflareDid this help you?
- 6Blocking specific international traffic and suspicious ASNsDid this help you?
- 7Delaying payment capture until items are shippedDid this help you?
- 8Temporarily hiding or disabling out-of-stock productsDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“We're getting hit with the same massive bot attacks daily, we even migrated over completely to Cloudflare and are paying their pro plan to stop it as much as possible...”source ↗
“Since yesterday I am having a huge bot traffic in my website. I am honestly a very small business run only by me and although I don’t fear for fraudulent orders (paid before fulfilment) the fear of cloning and identity theft is real.”source ↗
“You are not the only. We are having the same issue with shopify since December last year. We tried many things and nothing works and the reason is bc they work through shopify link checkout page.”source ↗
“I’ve been working with Wordpress for years, I got more hacked site the past year than never before… wp2shell is hitting hard and increasing day by day with unmaintained sites…”source ↗
Where this came up
People with this problem also raised
- 16How to stop excessive bot traffic and AI scrapers
- 8How to clean up a hacked website and fix malware
- 6Why is my website traffic suddenly spiking with no sales?
- 6Why does editing AI website code break other parts of the site?
- 4How to avoid paying $250 a month for routine website maintenance
- 3How to stop an email spam bomb attacking a user inbox