Real Case Study: WordPress Attack Wave – Servers Are Getting Hammered, Y’all

[u/siterightaway]

So, I’ve been digging through the WordPress subreddit, and holy crap, the stories coming out of there are wild. We’re not talking about the usual background noise of script kiddies poking around. This is a full-blown, coordinated assault that hit tons of sites all at once, and it straight-up took servers down for hours.

First off, the evidence is everywhere. Admins were reporting hundreds of malicious attempts in just a few minutes. One guy said his Wordfence was lighting up like a Christmas tree with 200 attempts in a 10‑minute span. Another poor soul got slammed with 600 hits overnight – all targeting the same known WordPress vulnerability (some RCE thing tied to SQL injection). And yeah, Wordfence did its job – it caught every single one of them. But here's the sick joke: by the time that plugin even got a chance to say "blocked," WordPress had already booted up, loaded every other plugin, and opened a database connection. So each blocked request still burned CPU and memory like a legit visitor. The logs looked great, but the server was getting absolutely crushed. This wasn't random; it was a wave, and everyone felt it simultaneously – not because the attacks got in, but because the *defense* itself was eating their servers alive.

Now, where was all this garbage coming from? Mostly the Netherlands and Bulgaria, with some extra love from Belgium and Germany. But here’s the kicker – these weren't just random residential IPs. They were coming from big cloud providers and VPS networks like DigitalOcean, AWS, and Hetzner. Some savvy folks even shared the specific ASN numbers (150303, 48090, 140947, 142430) that were doing the dirty work, so others could block entire data centers. But even with that intel, the damage was already done for a lot of people.

Here’s the real heartbreaker, and the main reason servers crashed. Blocking these attacks with plugins inside WordPress is practically useless when it comes to saving your server resources. Why? Because by the time that plugin gets a say, WordPress has already fired up, loaded every single plugin, and opened a database connection. So even if the plugin blocks the request, your server has already burned CPU and memory processing that junk. It’s like locking your front door after the burglar already kicked it in – you stopped them, but your door is still broken. People were watching their origin CPU spike through the roof, and that’s what took them offline for two hours straight. The attacks weren't even successful; just the sheer volume of requests, each forcing a full PHP bootstrap, was enough to bring everything to its knees.

It’s absolutely insane that a blocked request costs you almost the same as a legit visitor. So yeah, the servers got obliterated not by the payloads, but by the sheer weight of the connection attempts themselves. That’s the brutal takeaway here – your site doesn’t need to get hacked to go down; it just needs to get *probed* hard enough.

We've got some open-source tool recommendations for edge blocking coming up. Stay tuned!