I maintain a WordPress site for a very small community organization here in Australia, and have done so for almost a year now.
I was originally called in to assist with it because it had fairly malicious malware (the type that instantly and aggressively overwrites/replaces core WP files with its own backdoor code deep inside WP’s directory structure).
It was tough to fix but after a couple of days of work, I finally managed to permanently remove the malware, revoke its access, change all tokens/passwords etc and essentially clean it. No more site problems or weird connections. I then protected it with Wordfence, which has been absolutely excellent. I’ve been monitoring every single connection attempt super closely to confirm this.
This brings us to today – about a year on and the monthly Wordfence reports and realtime data I get sent indicate that there are over 1,000 malicious or suspicious IP addresses/user agents from all over the world trying to access known backdoor URIs and subsequently successfully being blocked each month.
Wtf? Is this normal?
The site has been hardened and secure for almost a year and there are still numerous connection attempts every day. It is in no way a high profile site (2 users, less than 100 posts) and doesn’t really contain anything of much monetary value. The site barely even has many links on Google.
Is this just a permanent thing going forward now… Because it was hacked once before it’s now forever a target? The number of malicious connections hasn’t decreased at all since the site was exorcised. The only noticeable difference is those attempts are no longer successful.
—–
Tl;dr WordPress site has been malware-free for about a year now. Why haven’t malicious requests decreased?
—–
Edit: To be super clear, the site is very secure now and I’m not really too concerned anymore that someone/something will get in – I’m just more very confused as to why there’s SO much malicious traffic and what’s driving that.