WordPress wp-config.php was modified — how to detect unauthorized changes

An attacker IP, routed through a compromised VPS, hit /wp-login.php 321 times in 91 seconds. The site's edge WAF terminated the requests at the HTTP layer before WordPress's authentication code ran. From inside the application, the login hook never fired, no failed-auth event was emitted, and no rule on those events had anything to evaluate. The attack happened, was correctly blocked, and produced a 12-minute silence at the application layer.

Two views side-by-side told the actual story: at the access-log layer, 92 HTTP 503s and 311 HTTP 499s from one IP against /wp-login.php; at the application layer, near-zero failed authentications during the same window. When the first is large and the second is empty, the WAF is doing the work, and that's the layer the attack story has to be read from.

This is the consistent edge case for application-layer behavioral monitoring: the harder the site is secured at the edge, the less an in-process monitor can say about what hit it. The operator wired the WAF's block-event hook into the same monitoring layer as the application signals, so future events flow into one place regardless of where they were stopped.