28,000+ Requests in 9 Days.
We Don't Even Run WordPress.

Every request below was logged by our Cloudflare telemetry on sunglasses.dev. These aren't hypothetical attacks — this is what actually hit our server in its first 9 days online. France-based infrastructure was the heaviest bot source, concentrated in the first 72 hours after launch.

Bar widths represent relative request volume from our telemetry sample. Exact counts vary by day.

• 42.5% of all websites run WordPress (W3Techs, April 2026) — the largest attack surface on the internet
• 7,966 new vulnerabilities found in WordPress plugins and themes in 2024 alone — that's ~22 per day (Patchstack)
• +34% year-over-year increase in vulnerability count vs 2023
• 96% of vulnerabilities were in plugins, not WordPress core
• 43% required no authentication to exploit
• 500,000+ infected websites observed in 2024, according to Sucuri
• 1,614 plugins/themes removed from the WordPress repository for unpatched security issues

Source: Patchstack — State of WordPress Security in 2025 (data period: 2024)

Most people know about brute-forcing /wp-login.php. Fewer know about xmlrpc.php — and it's far more dangerous.

XML-RPC's system.multicall method lets an attacker batch hundreds of authentication attempts into a single HTTP request. Instead of one login attempt per request (which rate-limiters catch), they send one request containing 500 username/password pairs.

What defenders see:

• Repeated POSTs to /xmlrpc.php
• Multicall payloads with nested wp.getUsersBlogs calls
• Correlated login failures or account lockouts
• High request body sizes relative to normal traffic

Fix: Disable XML-RPC entirely if you don't use it (most modern WordPress sites don't need it). At minimum, block system.multicall at the WAF level.

Here's the chain:

1. Website gets compromised through any of the methods above
2. Attacker injects hidden content — invisible text, SEO spam, or deceptive instructions buried in the page
3. AI browsing agent ingests the page during research, summarization, or retrieval
4. Hidden instructions influence the model's behavior — ignore safety policy, exfiltrate data, fetch malicious URLs, misuse tools
5. If the agent has tool privileges, the blast radius expands: file access, API calls, code execution

This is indirect prompt injection (OWASP LLM01:2025) — and compromised WordPress sites are one of the largest delivery surfaces for it.

Traditional web compromise response isn't enough anymore. You now need:

• Website integrity controls (prevent and detect compromise)
• AI ingestion-layer defenses (scan content before agents process it)

At the same time. This is the gap Sunglasses is built to fill.

Today (Priority 0)

• Block or rate-limit /wp-login.php, /xmlrpc.php, /wp-admin* for non-authenticated IPs
• Block probes for /.env, /.git/*, /wp-config.php at the WAF level
• Disable XML-RPC if you don't actively use it
• Enforce MFA and strong passwords for all admin accounts
• Remove unused plugins and themes — patch everything else immediately

This Week (Priority 1)

• Add virtual patching or a WAF tuned for WordPress plugin CVEs
• Run integrity checks for unauthorized admin users and file modifications
• Separate bot traffic from human traffic in your analytics
• Alert on .git, .env, and backup-file path probes

AI-Era Hardening (Priority 2)

• Treat external web content as untrusted input to AI agents
• Add pre-ingestion scanning for prompt-injection patterns and hidden directives
• Require policy checks and allowlists before tool execution from web-derived instructions
• Add human approval gates for high-risk actions triggered by browsed content

1. Cloudflare telemetry surfaced concentrated 4xx request patterns against CMS and secret-file paths
2. Honeypot analysis converted noisy scanner traffic into attributable threat intelligence
3. Pattern classification categorized probes by intent: credential abuse, secret-file recon, source theft
4. Cross-analysis separated commodity spray from higher-risk targeted behavior

We launched on April 1. The bots arrived within 72 hours. How?

Certificate Transparency (CT) logs. The moment our SSL certificate was issued, it appeared in public CT logs. Automated scanners monitor these feeds in real time using tools like CertStream. Research from SANS ISC and UC Santa Barbara confirms: network probes arrive "just seconds" after a CT log entry is published.

The heaviest early traffic came from France-based infrastructure — primarily OVH (OVHcloud), Europe's largest hosting provider headquartered in Roubaix, France. OVH operates 4.5+ million IP addresses and is well-documented as a source of automated scanning traffic:

• Scamalytics rates OVH traffic at a 59/100 fraud risk score
• Imperva's Bad Bot Report named OVH SAS as a known bot infrastructure provider
• 51% of all internet traffic in 2024 was bots (Imperva/Thales 2025 report)

This is not unique to us. Every new website on the internet goes through this. The difference is that we caught it, measured it, and are sharing the data.

What we know for certain

• 28,000+ total requests hit sunglasses.dev in its first 9 days online (Cloudflare analytics, verified April 9, 2026)
• 123 attacks were blocked by Cloudflare in the same period
• France-based infrastructure was the heaviest bot traffic source, concentrated in the first 72 hours after launch
• Bot requests targeted WordPress admin panels, login pages, config files, .env files, and .git directories
• Traffic originated from 75+ countries (US, FR, AU, CA, IN, NL, DE and others confirmed)
• Our site has zero WordPress components — every WordPress-path request was an automated probe

What we don't claim

• We cannot attribute specific requests to specific threat actors — this is commodity scanning, not targeted APT activity
• Exact per-path request counts are not available in Cloudflare's free tier analytics — bar chart shows relative volume from firewall event samples
• "France-based" means the request origin infrastructure was geolocated to France — not that the attackers are French
• Not all 28K requests were malicious — this total includes legitimate visitors, search engine crawlers, and bot traffic combined