Is your startup's infrastructure actually safe from automated botnets?

A few days ago, an old client I once helped set up backups for messaged me in an absolute panic: “Emergency! Help, our server has been hacked!”

Their project happened to be a typical WordPress build, but the root cause highlights a much broader issue that applies to almost any tech stack. They were relying on popular "security" modules that simply changed the admin login URL to a custom path a classic case of security by obscurity.

Spoiler: It didn't help at all.

Judging by the logs, automated botnets had been hammering the server 24/7 for weeks. These bots don't care about custom admin URLs or what framework you use. They scan everything indiscriminately, probing REST APIs, flooding common gateways, and looking for zero-day vulnerabilities in any third-party packages or dependencies.

Three days ago, they finally broke through. The attack sequence was brutal:

• Data theft: Exfiltrated a complete dump of the database and source files.

• Infiltration: Defaced the web application and injected hidden system accounts.

• Lockdown: Planted auto-starting backdoors and injected their own SSH keys for the system user.

• The Fail: Attempted to deploy a crypto miner... but the server was only saved because it literally ran out of disk space, causing their miner and cleanup scripts to crash!

So many founders and indie hackers naively think: "Who would care about my small MVP or side project?"

That is a dangerous mistake. Attackers aren't targeting you personally — automated bots roam the web 24/7 looking for any open door. They aren't just after your content; they want your infrastructure. They will use your server to mine crypto, turn your IP into a spam relay, or extract your .env files to drain your OpenAI API keys and AWS cloud credentials.

I'd love to hear how the PH community approaches this: Do you rely on app-level middleware and strong passwords, or do you restrict access to admin paths entirely at the Nginx/Cloudflare/firewall level?