WordPress: A Massive Spam Attack Foiled by AI

Key Takeaways

1A developer countered a spam attack on his WordPress site in two days by integrating new security measures.

2The attack exploited the username field to flood the site with fake accounts and messages related to cryptocurrency.

3The use of Codex and Claude Cowork helped strengthen the existing security plugin and identify the exploited vulnerabilities.

Why it matters : This intervention demonstrates how AI can be used to enhance website security against evolving threats.

A Targeted Spam Attack on WordPress

About a month ago, a developer's main site was the target of a massive spam attack. Spammers were using the username field as a message vector, filling it with a fake domain and cryptocurrency prompts such as "check balance," "withdraw funds" and "action required." WordPress then forwarded this payload in the form of thousands of "new user registration" emails.

At that time, the developer's server was using a commercially purchased security product meant to protect the WordPress site from registration spam. This product was clearly not up to the task. The developer is also the creator of a WordPress security plugin designed to help users restrict access to their sites. Since the registration spam security product he was paying for was not working, he decided to build spam protection into his existing plugin.

Developing the Solution

The developer quickly took screenshots of his Gmail inbox filled with a few hundred spam emails, fed those emails into Codex and asked it to write a mitigation routine that he could deploy quickly in his existing tool. Once Codex was done, he rolled out the improved plugin to users and on his own site.

The problem went from an active attack to complete silence in less than an hour. This was at the beginning of June. Then, last week, the attacks came back with a vengeance.

Analyzing the Attacks

Over the years, the developer has noticed that spammers tend to escalate. They send probes to sites to try to find easy vulnerabilities. If they find one, they exploit it. But once a mitigation is in place, the attacks do not simply disappear. They keep probing the site, looking for new ways in. In his view, AI is now being deployed by criminals to increase the depth of these probes.

The hosting provider informed the developer that his database had exceeded 39,000 user accounts with more than 700,000 user metadata records. They were seeing thousands of constant registrations. The developer saw this too, as his inbox and spam folder were receiving multiple variations at a fairly rapid pace. The user accounts dashboard was so cluttered that the page could not even load.

He was politely told that he needed to clean up his database and keep this from happening again. The unspoken subtext of this message was that if he failed to stop the attacks infecting their database infrastructure, his site would become persona non grata.

Setting Up the Defense

This weekend, the developer used Claude Cowork and OpenAI Codex to fight the spam, building much more robust mitigation features into his security product to counter the attacks.

As a side project, he has a fairly powerful security product that protects WordPress sites. Last year, he used Codex to significantly expand its capabilities. At the time, he had upgraded Codex to the Pro tier at $200 per month. After shipping those additions, he went back to the Plus tier at $20 per month. He is actively developing a series of products for the Apple ecosystem, and for that he uses Claude Code on the Max tier at $100 per month.

Le brief IA que lisent les pros

Le brief IA que les pros lisent chaque soir

Les 7 actus IA du jour, décryptées en 5 min. Gratuit.

Inclus dès l'inscription : notre sélection des meilleurs guides & comparatifs IA.

Choisissez votre rythme

Gratuit · Pas de spam · Désabonnement en 1 clic

Diagnosing with Claude Cowork

The developer's struggle began as a game of whack-a-mole in cybersecurity. How, exactly, were the criminals managing to get in? He had blocked the user registration page in his previous mitigation. He had even detected spam signals (machine-generated or gibberish usernames and malformed email addresses), used honeypot fields to trap bots, blocked registrations without valid MX records and checked registrations against the StopForumSpam blacklist.

Yet somehow the spammers were back in force. The developer spent about an hour combing through his site, finding no weak points. So he decided to deploy an AI.

He explained the problem to Cowork and let it get to work. At first, the AI wanted admin access, but the developer explained that spammers were finding exploits without admin access. The AI seemed to understand and started examining the site.

After about 40 minutes, it identified several issues. The most pronounced was that although the registration page had a CAPTCHA, spammers could submit URLs that would start a registration without asking for a CAPTCHA. This needed to be fixed.

Developing the Fixes

The developer exported his site database and fed it into Claude Cowork. He asked it to extract any information it could about identifying spam accounts and spam practices, based on what had historically managed to slip through the protections.

Cowork found several signals indicating that many accounts were spam. It also noticed that spammers were dumping URLs in the bio field (rather than the URL field). Claude helped identify the points of vulnerability on the site and specified new features to add to the plugin. The developer then asked Claude to write a prompt that he could pass to Codex so that it could implement the fixes for the identified vulnerabilities.

Using Codex

Codex, OpenAI's coding agent, is available in ChatGPT's $20 per month Plus tier. In one of his earlier coding sessions, the developer found Codex very powerful, but the amount of work it could do was fairly limited without an upgrade.

He wanted to see whether he could build the entire block of code needed to mitigate the spam attacks using only his existing ChatGPT Plus subscription. In short: he succeeded, but only just.

The developer used Codex to build three main systems:

He added extra signals to detect spam.
He added a registration CAPTCHA to every open entry point where something could try to sign up, including the standard WordPress registration form and other public entry points, such as REST API, XML-RPC, admin-ajax and custom registration forms.
He used Codex to add a spam account cleanup tool that uses all of the spam account signal analysis features to determine whether a user account is spam.

It was an intensive coding push over the weekend. For every hour this tool stayed undeployed, more and more user accounts were being created. The developer was in a race against time to stop it before the spammers or his hosting provider shut down his server.