Steinair.com: Traffic Incident Review

Sept 26 – 29, 2026 · Prepared by Media Relations Agency

253,000

bot requests in 3 days (51% of all site traffic)

197,000

unique IP addresses used by the bot

~10%

of real shoppers' page loads failed at peak

−94%

Saturday sales vs. the prior Saturday

What happened

A large, automated bot network flooded the site with requests for "add to cart" and "add to wishlist" links. It rotated through almost 200,000 IP addresses, mostly residential connections in Vietnam, Bangladesh, India, the US and Brazil, and faked common browser identities. That let it slip past normal per-visitor limits.

These links skip the site's page cache, so every request made the server do full WooCommerce work. The server ran out of capacity and began returning timeout errors (504) to real customers.

Current status: WP Engine detected the event and switched on "Under Attack Mode" at 2:45 PM CT on Tue 9/29. Bot traffic and errors dropped to near zero within five minutes. No data was compromised. We checked the logs for login attacks, file-upload attempts and other break-in signs, and all of them were blocked.

Timeline (Central Time)

When	What we saw	Customer impact
Sat 9/26 (already underway by 3 PM)	Full-strength attack, 4,000–8,000 bot hits per hour	~10% of page loads failed
Sun 9/27	Attack continued, slightly lower	2–4% of page loads failed
Sun 9/27 ~10 PM – Mon evening	Bot paused, then slowly returned	Normal
Tue 9/29, 10 AM – 2:45 PM	Heaviest wave, up to 11,500 IPs per hour	4–8% of page loads failed
Tue 9/29, 2:45 PM	Under Attack Mode enabled by WP Engine	Errors stopped

Sales impact

Sat 9/19 (normal)

$1,046

Sat 9/26 (attack)

$62

Saturday was the worst day of the attack, and sales fell by about $980 (−94%) compared with the Saturday before. Every order needs several pages to load in a row: product, cart, checkout and payment. With about 1 in 10 page loads failing, and the pages that did load running slowly, many shoppers likely gave up before completing an order.

The full week of Sept 21–27 still came in at $24,024, up 30% from the prior week's $18,482. The two strongest days, Mon 9/21 and Wed 9/23, came before the attack began.

Worth checking: Compare today's (Tue 9/29) orders with a normal Tuesday. Customers saw errors from about 10 AM until 2:45 PM. Also check for orders stuck in "Pending payment" status during those hours.

Note: one day's comparison can be affected by normal variation. The attack is the most likely cause of the Saturday drop, but it may not account for all of it.

Recommendations

NowLeave Under Attack Mode on for the moment. The bot has already paused and come back once. Shoppers will see a brief "checking your browser" screen, which is a small cost compared with lost orders.
NowAsk WP Engine for a targeted firewall rule. The rule should block requests containing add-to-cart or add_to_wishlist in the link when the visitor has no active shopping session. It should also rate-limit uncached requests. This stops this specific bot at the network edge. Once it's in place, Under Attack Mode can be turned off and real shoppers won't see a challenge.
NowWatch payments and ads during the challenge period. Confirm that Authorize.net orders are completing normally and that the Google Merchant Center product feed isn't reporting errors. Consider lowering Google Ads spend until the challenge screen is removed.
This weekRemove the old "add to cart" and "wishlist" links that bots can crawl. The wishlist plugin is already turned off, so the bot is replaying an old list of links. We will block these link types in robots.txt and switch the store's buttons to modern AJAX-only behavior, so these links no longer appear in the page code at all.
This weekSecurity cleanup.
- Remove WP File Manager. This plugin has a history of serious break-in vulnerabilities, and it isn't needed on WP Engine.
- Remove the demo-import and importer tools, which aren't needed on a live store.
- Update Slider Revolution, WPBakery and Wordfence.
- Keep only one of the two security plugins, Wordfence or WP Cerber. Running both creates overlap and extra server load.
Next 30 daysImprove server resilience. Ask WP Engine why PHP OPcache shows as unavailable. Enabling it makes every uncached page faster, so the site can absorb traffic spikes better. After that, review the remaining 12 inactive plugins and delete any that aren't needed.