WordPress site under massive automated attack — Cloudflare Free not stopping it

WordPress site under massive automated attack — Cloudflare Free not stopping it

Hi everyone,

I’m dealing with a serious automated attack against a WordPress website and would really appreciate some advice from the Cloudflare community.

The website is hosted on Hostinger Cloud Startup. It was recently moved behind Cloudflare Free because the traffic/attack was becoming difficult to handle at the origin.

The attack appears to be highly automated and is coming from 150+ unique IP addresses, making simple IP blocking ineffective. The requests are also distributed across different IPs and appear to be targeting the website continuously.

What I’ve tried so far:

  • Cloudflare Free plan
  • Bot Fight Mode
  • Multiple WAF/custom rules
  • IP-based blocking
  • User-Agent based rules
  • Various challenge/block rules
  • Reviewing Cloudflare Security Events

Cloudflare is clearly detecting/blocking a significant amount of the traffic, but the problem is that the website itself is still becoming inaccessible/unresponsive, especially during the attack.

From what I can see, this isn't simply a handful of bad IPs — it looks more like a distributed automated attack.

My questions:

  1. What would be the best WAF strategy for this type of WordPress attack?
  2. Should I focus on rate limiting, URI/path-based rules, ASN/hosting-provider blocking, or something else?
  3. Is Cloudflare Free sufficient for this type of attack, or would Pro/Super Bot Fight Mode make a significant difference?
  4. How can I make sure these requests are stopped at Cloudflare and don't continue consuming Hostinger/origin resources?
  5. Are there specific Cloudflare rules you recommend for WordPress under this kind of automated attack?
  6. How can I preserve SEO efforts & what should I make changes in Search Console?

I’ve attached a screenshot showing the traffic pattern.

I’d really appreciate any recommendations from people who have dealt with a similar situation.

Thanks!

u/digitalnomad_eu — 2 days ago
▲ 1 r/SEO

Join the First-Ever Clean Web Day – Help Make the Internet Safer

Over the past year, I've noticed a significant increase in AI-generated spam, hacked websites, toxic backlinks, phishing pages, and low-quality content affecting search results. I'm putting together a community initiative called Clean Web Day to educate NGOs, public sector organizations, and small businesses through live website audits and awareness sessions. Before finalizing the agenda, I'd genuinely like to hear from the SEO community: What do you think is the biggest threat to the web today, and what practical topics should we cover to help website owners?

reddit.com
u/digitalnomad_eu — 2 months ago

🚨 Join the First-Ever Clean Web Day 🌐

The internet is becoming increasingly affected by spam, AI-generated low-quality content, toxic backlinks, phishing, malware links, and email spam. It's time for the community to come together and make the web a safer place.

We're launching the first-ever Clean Web Day, and we'd love to invite:

• NGOs & nonprofit organizations
• Public sector organizations
• Small & medium businesses (SMBs)
• Technical SEO professionals
• Digital marketers
• WordPress professionals & web developers
• Anyone passionate about improving the web

💚 You can support the initiative by pledging a few hours to help website owners and organizations improve their online presence.

What to expect during Clean Web Day?

✅ Live website & SEO audits
✅ Awareness sessions on internet spam and online threats
✅ Discussions on:

  • AI-generated spam content
  • Email spam
  • Malware & harmful links
  • Toxic backlinks
  • Search engine spam
  • Website security best practices

Our goal is simple: educate, help website owners, and encourage better practices for a cleaner, healthier internet.

If you'd like to volunteer, pledge your time, or simply attend, we'd love to have you join us.

Together, let's make the web a little cleaner—one website at a time. 🌍

reddit.com
u/digitalnomad_eu — 2 months ago

Elementor editor extremely slow on a large site – looking for architecture advice

Hi everyone,

I'm working on a fairly large university website built with Elementor Pro + ACF Pro on WP Engine. The frontend is fast, but the Elementor editor has become painfully slow.

Some context:

  • ~100 pages
  • ~180 news posts
  • ~1,000 media items
  • Elementor Pro + ACF Pro
  • PHP 8.4, WP Engine
  • 16 active plugins
  • Strong server resources (512MB memory)

What stands out is the Elementor structure:

  • ~4,400 containers
  • ~1,400 headings
  • ~1,200 text widgets
  • ACF is used heavily throughout the site

The biggest issues are:

  • Editor takes a long time to open (especially larger pages)
  • Saving/updating is slow
  • WP Admin and frontend performance are otherwise fine

I'm trying to understand whether this is simply Elementor hitting its practical limits, or whether it's more of an architecture problem.

For those who've worked on large Elementor sites:

  • Is ~4,400 containers unusually high?
  • What tends to be the biggest bottleneck in cases like this (nested containers, DOM size, ACF, page JSON, etc.)?
  • What optimizations have actually made a noticeable difference without rebuilding the site?

A full rebuild isn't an option right now, so I'm mainly looking for practical ways to improve performance within Elementor.

Would love to hear from anyone who's dealt with Elementor at this scale. Thanks!

reddit.com
u/digitalnomad_eu — 2 months ago

Elementor editor extremely slow on a large site – looking for architecture advice

Hi everyone,

I'm working on a fairly large university website built with Elementor Pro + ACF Pro on WP Engine. The frontend is fast, but the Elementor editor has become painfully slow.

Some context:

  • ~100 pages
  • ~180 news posts
  • ~1,000 media items
  • Elementor Pro + ACF Pro
  • PHP 8.4, WP Engine
  • 16 active plugins
  • Strong server resources (512MB memory)

What stands out is the Elementor structure:

  • ~4,400 containers
  • ~1,400 headings
  • ~1,200 text widgets
  • ACF is used heavily throughout the site

The biggest issues are:

  • Editor takes a long time to open (especially larger pages)
  • Saving/updating is slow
  • WP Admin and frontend performance are otherwise fine

I'm trying to understand whether this is simply Elementor hitting its practical limits, or whether it's more of an architecture problem.

For those who've worked on large Elementor sites:

  • Is ~4,400 containers unusually high?
  • What tends to be the biggest bottleneck in cases like this (nested containers, DOM size, ACF, page JSON, etc.)?
  • What optimizations have actually made a noticeable difference without rebuilding the site?

A full rebuild isn't an option right now, so I'm mainly looking for practical ways to improve performance within Elementor.

Would love to hear from anyone who's dealt with Elementor at this scale. Thanks!

reddit.com
u/digitalnomad_eu — 2 months ago

Did anyone ever signed up with Techstars accelerator program as WordPress Product that scale to other tech stacks too?

We're going to apply for Techstars Accelerator program as a WordPress product that would be scaled out of WordPress too in same niche.

Just curious if anyone signed up before based on WordPress product that actually scale, would be a great case study to learn.

Any advise, tips or recommendations are more than welcome.

reddit.com
u/digitalnomad_eu — 2 months ago

What things should matter for Techstars accelerator program?

Applying for the very first time for Techstars Accelerator program where we have got a really good traction through partnerships & got our very first 50 paid subscribers by having around 6k+ active free users.

We've our own custom CRM where we track buying journey, keep track of users activation & deactivation etc.

Also started reaching out to them via automated email series. There is a really good potential & I think its genuinely adding value for people what we've built.

Any clue or tips would be greatly helpful as applications are closing soon.

reddit.com
u/digitalnomad_eu — 2 months ago

Do partnerships work better than paid ads for WordPress plugins?

Real Case Study:

I’ve been thinking about growth channels for WordPress products and wanted to get opinions from this community.
We started a small SEO plugin/product and initially were getting around ~5 downloads/day through organic discovery.
Instead of focusing on paid ads, we tried something different — partnering with a popular theme in a niche directory.
After that partnership, we saw roughly 10x growth, and over time the product has reached 30K+ downloads.

What we learned so far:
Paid ads didn’t really move the needle early on
Distribution through themes/plugins had a much stronger impact
Users tend to trust recommendations inside their existing workflow

Curious what others think:
Do you rely more on partnerships or paid marketing for WordPress products?
If you’re a plugin/theme author, do you see value in collaborating on SEO or utility features for your users?
What has worked best for you in terms of distribution?
Open to sharing more details and also happy to connect with plugin/theme authors if there’s a good fit.

reddit.com
u/digitalnomad_eu — 3 months ago
▲ 3 r/WordPressPakistan+1 crossposts

SEO Repair Kit — Beta for Custom & Vibe-Coded Websites (Loveable / Replit)

We’ve built SEO Repair Kit — already available for WordPress — and we’re now rolling out a beta for custom-built, vibe-coded websites.
Tools like Loveable and Replit make it super easy to ship websites, but they usually don’t include a proper SEO layer out of the box.

The problem
Custom sites often miss basic SEO essentials:
Broken links
Missing alt text
Meta tag issues (titles/descriptions)
Sitemap / robots.txt problems
Missing Open Graph / Twitter tags
Indexing & crawl issues

What we’re testing
A lightweight SEO layer for custom websites that helps with:
Technical SEO checks
On-page SEO validation
Clear issue detection + fixes

We’re launching the beta soon and looking for feedback from builders using modern/custom stacks.
What SEO issues do you usually end up fixing manually after launch?

reddit.com
u/digitalnomad_eu — 3 months ago
▲ 6 r/WordPressPakistan+2 crossposts

SEO for custom / vibe-coded websites (Loveable) — how are you handling it?

Curious how others are handling SEO for custom-built or “vibe-coded” websites created with tools like Loveable.

In WordPress, SEO plugins handle most of the technical + on-page basics, but that layer usually doesn’t exist for custom stacks.

Common gaps in custom sites:
Broken internal/external links
Missing image alt text
Meta tag issues (titles/descriptions)
Sitemap / robots.txt setup
Missing Open Graph / Twitter cards
Indexing & crawlability issues

Question
When you ship custom or AI-generated websites, how are you handling SEO today?
Do you manage it manually after deployment?
Use any tools or workflows?
Or is it mostly ignored unless traffic becomes an issue?
Trying to understand how big this gap actually is in real workflows.

reddit.com
u/digitalnomad_eu — 3 months ago
▲ 0 r/replit

Any Replit official here?

Our product is ready & there can be a really good opportunity with Replit & we’d like to reach out to officials for integration proposal.

Already submitted form on the website & never heard back!

reddit.com
u/digitalnomad_eu — 3 months ago

How to Update to WordPress 7.0 Safely — A Step-by-Step Guide

WordPressPakistan | Weekend Read

WordPress 7.0 is out and it's a big one. But before you hit that update button, take 10 minutes to do it the right way. Rushing a major update on a live site can break things — and nobody wants a panicked Sunday fixing a client's website.

Here's how to do it safely.

⚠️ Before You Do Anything

1. Back up your site completely Back up your files AND your database. Use a plugin like UpdraftPlus or JetPack, or ask your hosting provider. No backup = no safety net.

2. Check your PHP version WordPress 7.0 recommends PHP 8.3 or higher. Log into your hosting panel and check. Running an older version can cause errors after updating.

3. Check your plugins and themes Visit each plugin's page on wordpress.org and confirm it's been tested with WordPress 7.0. Outdated plugins are the number one cause of broken sites after a major update.

✅ The Safe Update Process

Step 1 — Test on a staging site first Most good hosts (Cloudways, SiteGround, Kinsta) offer a one-click staging environment. Clone your site, update there first, and see if anything breaks — before touching your live site.

Step 2 — Deactivate non-essential plugins Temporarily turn off plugins you don't critically need before updating. Makes it much easier to identify what caused a problem if something goes wrong.

Step 3 — Update WordPress core Go to Dashboard → Updates and click Update to WordPress 7.0. The process takes about a minute.

Step 4 — Reactivate and test Turn your plugins back on one by one. Check your homepage, contact forms, checkout pages, and anything critical to your site.

Step 5 — Clear your cache If you use a caching plugin (WP Rocket, W3 Total Cache, LiteSpeed), clear all cache after updating. Many display issues after updates are just stale cache.

🚨 Something Broke — Now What?

Don't panic. Here's the order to follow:

  • Deactivate all plugins and check if the issue is gone — if yes, reactivate one by one to find the culprit
  • Switch to a default theme (like Twenty Twenty-Five) to rule out a theme conflict
  • Restore your backup if nothing else works — this is why Step 1 exists

💡 Quick Tips

  • Always update on a weekday morning for client sites — not Friday evening
  • Never update a live WooCommerce store without testing checkout on staging first
  • Keep WordPress auto-updates off for major versions — always update manually so you're in control

Ready to Update?

WordPress 7.0 brings AI integration, a modernised dashboard, new blocks, and a lot more. It's worth updating — just do it right.

Download WordPress 7.0wordpress.org/download

Any questions about updating? Drop them in the comments and our community will help you out 👇

u/digitalnomad_eu — 3 months ago
▲ 4 r/WordPressPakistan+2 crossposts

The Internet Is Drowning in Spam — and We Can Do Something About It

Some numbers that genuinely shocked me:

  • 51% of all web traffic is now bots — more than human activity for the first time ever
  • 45–50% of all emails are spam — 176 billion junk messages every single day
  • 30% of online reviews are fake — and AI is making it worse, growing 80% month over month
  • Cybercrime is projected to cost $11.5 trillion by end of 2026

As WordPress site owners and developers, this affects all of us — fake backlinks hurting our SEO, phishing emails targeting our clients, bot traffic polluting our analytics.

There's a global initiative called Clean Web Day happening this year — a 24-hour push where website owners, developers, and everyday users audit and clean up their digital footprint together. Free tools, free guides, no cost.

Curious if anyone in the Pakistani WordPress community is already doing regular site audits or dealing with spam issues? Would love to hear what's working for you.

Have you checked your backlink profile or spam score recently? Drop your thoughts below 👇

reddit.com
u/digitalnomad_eu — 3 months ago
▲ 3 r/WordPressPakistan+1 crossposts

Global Accessibility Awareness Day (GAAD) 2026 is happening right now, organized by Equalize Digital 🌍♿

It’s wonderful to see contributors from Pakistan actively participating in accessibility efforts. Team members from TorontoDigits joined the initiative by testing accessibility-ready WordPress themes, reporting issues, and sharing feedback with theme developers.

It was a lovely experience contributing alongside the global WordPress community and helping make the web more accessible for everyone.

Accessibility is not just about compliance — it’s about inclusion.

More details about the event:
GAAD 2026 by Equalize Digital

Would love to know if others from the Pakistan WordPress community also participated this year 👏

reddit.com
u/digitalnomad_eu — 3 months ago

WordPress 7.0 "Armstrong" Is Here — Pakistan Was Part of It! 🇵🇰

WordPress 7.0 "Armstrong" officially launched on May 20, 2026 — named after jazz legend Louis Armstrong. This is a major milestone, with 900+ contributors worldwide delivering 420+ enhancements and fixes.

And Pakistan was part of it.

What's New?

  • AI in Core — WordPress can now connect to AI models directly from your dashboard
  • New Dashboard — Fresh design, smoother experience, and a new font management page
  • New Blocks — Gallery lightbox, Breadcrumbs, Icons, and more
  • Developer Tools — Build blocks with PHP only, and a more extensible Site Editor

🇵🇰 Pakistani Contributors

Junaid Ahmed (@junaidkbr, Islamabad) and Adnan Hyder Pervez (@adnanhyder) are both confirmed contributors in the official WordPress 7.0 credits — representing Pakistan on a global stage.

🎉 Pakistan at the Release Party

Four members of our community joined the live WordPress 7.0 release party in the #core Slack channel on May 20 — Sana Yasir, Abdullah Ramzan, Ashir Habib, and Waqas Safdar — along with several other Pakistani contributors behind the scenes.

Pakistan was in the room when this went live. That's something to be proud of.

Get Involved

Drop your thoughts in the comments — and if you want to contribute to the next release, we'd love to help you get started.

u/digitalnomad_eu — 3 months ago

Good News for Pakistani Undergrads: WordPress Credits Program Opens Global Path to Tech Careers 🌍

Good news for students in Pakistan who want to start a career in WordPress, web development, or open-source 👇

The WordPress Credits Program is an official initiative by the WordPress Foundation that connects university students with the global open-source WordPress ecosystem through real, mentored contributions.

It is designed to help students gain practical experience while earning academic credit through structured university programs.

🌍 What is WordPress Credits?

WordPress Credits is a contribution-based academic program where students:

  • Work on real WordPress projects (development, design, content, translation, testing, etc.)
  • Learn open-source collaboration with experienced mentors
  • Earn academic credit through structured contribution work
  • Build a public portfolio of real contributions

The program was first launched with the University of Pisa and announced at WordCamp Europe 2025, and is now expanding globally. (WordPress.org)

⚙️ How the program works

It typically runs over a semester (13–18 weeks) and follows 3 phases: (Make WordPress)

1. Onboarding

Students learn:

  • WordPress tools and ecosystem
  • Open-source workflows and collaboration
  • Communication standards in global communities

2. Project Work

Students:

  • Contribute to real WordPress projects
  • Work under mentorship from experienced contributors
  • Participate in weekly feedback and syncs
  • Track contribution progress

3. Wrap-up

Students:

  • Present their work
  • Share learnings
  • Complete academic evaluation

🎓 How students participate

👉 Students do NOT apply individually like a job portal.

Instead:

  • Participation happens through universities or academic programs
  • Students join via enrolled courses
  • Work is guided by professors + WordPress mentors

🏫 How universities (including Pakistan) can onboard

Universities can become official WordPress Credits partner institutions by applying through the program onboarding process.

👉 University onboarding link:
https://airtable.com/appIzQKfwTn5dyPVp/shrYvY0CDNIkILIre

Universities typically:

  • Integrate WordPress Credits into curriculum
  • Allow students to earn credit via real contributions
  • Coordinate with WordPress Foundation mentors
  • Run structured semester-based cohorts

🧑‍🏫 Mentors in the program

Mentors are a core part of WordPress Credits.

They:

  • Guide students through real open-source contributions
  • Provide weekly feedback and support
  • Help shape project direction and learning outcomes

👉 Mentor call & details:
https://make.wordpress.org/handbook/wordpress-credits-contribution-internship-program/a-guide-for-wp-credits-mentors/call-for-mentors

🌍 Participating institutions (global)

The program already includes universities across:

  • Europe (Italy, Spain, Poland, Latvia)
  • Americas (USA, Costa Rica, Bolivia)
  • Asia (Bangladesh, India)

Including institutions like:

  • University of Pisa
  • Krakow University of Economics
  • Central New Mexico Community College
  • Riga Nordic University
  • and others expanding globally (Make WordPress)

🌍 Impact & why it matters

This program is more than learning WordPress:

  • 🌍 Open-source contribution mindset → students become part of global software
  • 🌐 International exposure → work with global mentors and contributors
  • 🧠 Tech grooming → real workflows used in global companies
  • ⚖️ Ethics & responsibility → learning transparent, community-driven development
  • 🚀 Career readiness → freelancing, agencies, and remote job opportunities

🇵🇰 Why this matters for Pakistan

For undergrads in Pakistan, this is a big opportunity because:

  • WordPress powers a huge portion of the web
  • It removes “no experience” barriers
  • Builds real global portfolios
  • Opens freelancing and remote career paths early

If anyone here knows about Pakistani universities exploring WordPress Credits or similar programs, would love to hear your thoughts 🙌

reddit.com
u/digitalnomad_eu — 3 months ago
▲ 1 r/WordPressPakistan+1 crossposts

What’s the most complex WordPress publisher or media project you’ve worked on — and how is AI changing it?

Curious to hear from people working on larger WordPress projects, especially in publishing or media.

What’s the most complex WordPress project you’ve worked on recently in this space?

For example:

  • news or magazine websites
  • high-traffic publishing platforms
  • multi-author editorial systems
  • global or multilingual content sites
  • performance-heavy media portals
  • migrations from other CMS platforms

And what were the biggest challenges?

  • scaling traffic during breaking news spikes
  • caching and performance tuning
  • editorial workflows and approvals
  • SEO and indexing at scale
  • plugin limitations or architecture issues
  • maintaining site stability under load

Also curious how things are changing with AI in the mix.

Is AI actually impacting how agencies and publishers work on WordPress projects?

For example:

  • content generation vs editorial control
  • faster publishing workflows
  • SEO automation
  • reduced manual work vs new quality challenges
  • changes in how teams are structured

Trying to understand what “modern WordPress publishing” looks like in 2026 from people actually building and maintaining these systems.

Would love to hear real experiences.

reddit.com
u/digitalnomad_eu — 3 months ago