AI tools help attackers try stolen passwords and old plugin holes faster. Campaigns in October 2026 (SOCRadar on CyberXero) showed bots dropping webshells soon after they find a hole. Wordfence 2024 logged more than 54 billion bad requests. Bedrock slows the automated wave, watches for takeover, and can clean up with Shield Care if the site is already hit.

On the site: dual login limits (per IP and per username), an early must-use drop for empty user-agents and probe sequences, 404 storm limits, a login honeypot, and extra scan signatures. Training scrapers (GPTBot, ClaudeBot, Bytespider, Amazonbot, PerplexityBot) are blocked by default. Search bots stay allowed. Claimed user-agents never skip rate limits.

If Cloudflare is connected, Hub Cloud pushes AI-bot, REST user-list, and login/xmlrpc challenge rules. Login rate limit at Cloudflare needs a paid plan. The plugin still rate-limits wp-login on every plan.

This does not patch PHP or WordPress. It is not bulletproof. A person can still break in. You never change DNS. Read the short note or Ask for a $199 cleanup.