Smarter hacking-probe alerts — no more false alarms on WordPress sites
Hacking-probe alerts no longer flag ordinary visitors loading WordPress assets or verified search-engine crawlers, so the alerts you see now represent genuine scanning activity.
Our automated hacking-probe detection watches for requests that look like vulnerability scanning — probes for exposed config files, admin panels, and known-vulnerable paths. On WordPress sites, it was too eager: ordinary visitors loading standard WordPress assets (scripts under /wp-includes/, images under /wp-content/uploads/) could be flagged as attackers, which on busy sites buried real threats under thousands of false "critical" alerts.
Three improvements ship today:
- Your own traffic is no longer suspicious. A request the site serves
normally is not treated as a probe. Genuine exposures — a 200 on /wp-config.php, /.env, /.git/config, and similar sensitive paths — are still flagged as critical, and probing for paths that don't exist is still detected.
- Verified crawlers are excluded. Googlebot and other search-engine
crawlers verified against their official IP ranges no longer appear as "attackers" in probe alerts.
- Fewer duplicate alert narratives. Repeat alerts for the same ongoing
incident now reuse the existing AI triage summary instead of generating a new one each time, so an alert storm reads as one incident rather than hundreds.
Existing alert history is unchanged. If you had email notifications muted because of the noise, it should be safe to switch them back on.