Of the attack patterns that show up repeatedly in WordPress security logs, coordinated botnet scanning is the one that looks most alarming at first glance and is actually the most misunderstood.
“The most alarming attacks are often the most misunderstood.”
The alarm comes from what you see in the logs: multiple requests arriving within seconds of each other, from multiple countries simultaneously, all targeting the same endpoint. It looks like a coordinated human attack. It is coordinated, but there are no humans watching it happen.
What a botnet actually is
A botnet is a network of compromised systems being used without their owners’ knowledge. What makes modern botnets different from the version most people imagine is the source of those systems.
The IPs you see in logs are not anonymous throwaway servers spun up specifically for the attack. They are compromised legitimate servers: business mail infrastructure, shared hosting servers, dedicated servers run by real companies in multiple countries. The operators of those servers typically have no idea their systems are participating in anything.
“A botnet isn’t one server attacking thousands of websites; it’s thousands of compromised servers attacking at once.”
This distinction matters because it changes how you defend against these attacks.
Blocking a single IP address may stop one request, but the next request could arrive seconds later from a different legitimate server in another country. Blocking entire countries has similar limitations when compromised systems exist across the globe.
“The IP address you’re blocking today may belong to an innocent business tomorrow.”
Scanning comes before exploitation
One important point is often overlooked. Most automated requests are not attempts to compromise your website immediately. They are scanning for potential targets.
Attackers first want to answer a simple question:
Is this site vulnerable?
If the answer is yes, the site may be added to a list for further exploitation later.
“Attackers automate curiosity first, exploitation second.”
This is why scanning activity often spikes shortly after a new vulnerability is publicly disclosed. As soon as a new CVE becomes public, attackers rapidly automate detection and begin scanning millions of websites.
What the scanner is probing for
A common target in WordPress botnet scans is a specific API endpoint, typically associated with a plugin that has a known vulnerability in older versions.
In the logs that inspired this article, the requests targeted a GraphQL endpoint. GraphQL is a query language for APIs, aand several WordPress plugins expose GraphQL endpoints to make site data accessible.
It is important to understand that GraphQL itself is not a vulnerability.
When unintentionally exposed, an introspection query can reveal:
- Available data types
- Fields
- Relationships
- Supported operations
In effect, it provides a detailed blueprint of the application’s API.
“An introspection query can turn your API into its own blueprint.”
In some vulnerable plugin versions, attackers may also be able to combine this information with other weaknesses to extract data or bypass authentication.
The key detail most people miss
The scanner does not know whether the plugin is installed before it sends the request. It sends the request to every WordPress site it can reach and records which ones respond in a way that suggests vulnerability.
That means:
- Sites without the plugin still receive the request.
- Sites running outdated versions may unintentionally advertise their exposure.
- Even inactive plugins can reveal information if their files remain on the server.
What makes the timing pattern significant
Requests arriving in near-simultaneous waves from multiple countries are the signature of a botnet operating across a distributed network. The waves often appear at fixed intervals, sometimes hours apart. This is not coincidence. It is a scheduled scan running across a large number of controlled systems at once.
A single attacker from a single location probing your site looks different in the logs and is easier to block. A botnet running the same probe from ten different countries across legitimate hosting infrastructure in the same second is harder to filter without catching legitimate traffic in the crossfire.
Why IP blocking is rarely enough
IP blocking has its place, but it is not an effective long-term strategy against distributed botnets.
Modern botnets continuously rotate through compromised infrastructure.
Some requests originate from:
- Shared hosting providers
- Business networks
- Cloud platforms
- Residential connections
Blocking each IP individually quickly becomes an endless game.
Likewise, blocking entire countries can unintentionally affect legitimate visitors while still allowing the attack to continue from elsewhere.
The defense that matters here
The highest-leverage action is at the CDN or firewall layer: block requests to known API endpoint paths before they reach your application. An application-level security plugin will still catch what gets through, but every request that reaches your application consumes server resources. Stopping it upstream costs nothing.
“The cheapest request to process is the one your server never receives.”
Beyond perimeter protection, a layered security approach is the most effective:
- Keep WordPress core updated.
- Update plugins and themes promptly.
- Remove plugins you no longer use.
- Restrict unnecessary API endpoints.
- Apply rate limiting where appropriate.
- Monitor logs for recurring patterns instead of isolated events.
- Use a reputable security plugin as an additional layer of defense.
Final thoughts
Most WordPress websites are not targeted because they are valuable. They are targeted because they are reachable.
Botnets don’t discriminate between a personal blog, a business website, or an enterprise platform. Automated scanners simply work through massive lists of internet-facing websites looking for known weaknesses.
Good security isn’t about becoming invisible.
It’s about ensuring that when automated scanners arrive, they find an up-to-date, well-maintained website with layered defenses, making exploitation difficult enough that they simply move on to easier targets.
Read More: