Why Bots Are Scanning Your WordPress Site Around the Clock

It is not personal. Bots are automated programs running 24 hours a day, scanning millions of websites at once. They are not looking for your business specifically. They are looking for WordPress. Your site is being swept up in a dragnet, not singled out. But the effect on your site is the same either way.

What are bots actually looking for?

Bots are looking for known weaknesses. A security researcher finds a vulnerability in a popular plugin and publishes a disclosure. Within hours, automated tools start scanning every WordPress site on the internet, looking for sites still running that plugin version.

They look for specific things: the WordPress login page, which is always at the same address. Known plugin file paths. Outdated software versions. Weak passwords on administrator accounts. PHP files in places they should not be.

When they find a match, they probe it. If the probe succeeds, they take action, whether that is installing malware, adding spam links, using your server to send emails, or handing the compromised site to a human attacker.

Why is WordPress the main target?

WordPress powers roughly 43 percent of all websites on the internet. That is an enormous share of a very large number.

For an attacker building an automated scanning tool, that math is simple. One playbook that works against WordPress finds more targets than any other single approach. The attack surface is enormous and highly predictable.

Every WordPress site has the same login URL structure. Every WordPress site has the same plugin directory path. The file structure is consistent across millions of installations. That consistency, which makes WordPress easy to build on, is also what makes it easy to attack at scale.

What does this look like in your security logs?

A typical WordPress site, even a small one with modest traffic, will show hundreds to thousands of automated requests in its security logs every day. These are not human visitors. They are bots probing for vulnerabilities.

During a broader scan wave, when a major vulnerability is disclosed and attackers deploy tools to find exposed sites, the request volume spikes. A small business site can see thousands of probes in a single hour.

Your real visitors are a small fraction of the traffic hitting your server. The majority is automated. Most of it is looking for a way in.

What does this mean for your maintenance workload?

Keeping up with bot-related threats is not a one-time task. In 2025, researchers found 11,334 new WordPress vulnerabilities. Ninety-one percent came from plugins. Each new disclosure is a new thing for automated tools to scan for.

Staying ahead of this requires reviewing your security logs, updating plugins quickly after vulnerability disclosures, running a firewall, and monitoring for signs of compromise. That is time every week, not just a one-time setup.

For a business owner without dedicated IT staff, that is time taken away from the business.

You can read more about how login attacks work specifically in WordPress login attacks per day. For a broader look at why WordPress gets targeted so much, read why WordPress attracts automated attacks.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.