WordPress Gets Scanned Every Hour. Core Does Nothing About It.

WordPress, which powers a significant portion of the internet, is the most frequently scanned content management system (CMS) online. Every hour, bots relentlessly scan for weaknesses, attempting to exploit common vulnerabilities like the hidden backup file wp-config.php.bak, the XML-RPC API, and default admin paths. Despite this constant threat, WordPress core itself does not provide robust protection.

Instead, it relies on the security measures implemented by individual hosting providers, security plugins, or good fortune. To address this gap, a new plugin called xZeroProtect has been developed. This firewall sits between every incoming request and WordPress, analyzing it against a set of rules designed to detect known scanners, exploit tools, SQL injection attempts, and other malicious activity.

If a request matches any of these rules, it is automatically blocked and logged. While rate-limited attacks from repeat offenders may be banned, legitimate visitors are allowed through. One of the key benefits of xZeroProtect is its ability to distinguish between automated bots like Googlebot and human traffic. By verifying Googlebot and other major crawlers through double-DNS resolution, the plugin ensures that these legitimate sources are not mistakenly blocked by rate-limiting or other security measures.

Additionally, xZeroProtect does not rely on external services, databases, or complex configurations, making it suitable for most shared hosting environments. The plugin operates purely at the request level, working before WordPress routes the request, which means it does not interfere with other plugins or WordPress features. It also operates in a "learning mode" that logs potential violations without blocking them, allowing site owners to review and fine-tune the settings before fully activating the firewall.