---
title: "The WordPress load-scripts.php Vulnerability (CVE-2018-6389) and How to Protect Your Site"
description: "**In short**WordPress load-scripts.php combines JavaScript files into a single request. In 2018 it was shown that an attacker can request all files through it at once, repeatedly, exhausting CPU and memory and taking the site down (a denial of service).…"
url: "https://www.hyyat.com/en/knowledgebase/wordpress-load-scripts-vulnerability/"
updated: "2026-10-21"
category: Website Security
---

# The WordPress load-scripts.php Vulnerability (CVE-2018-6389) and How to Protect Your Site

**In short**WordPress load-scripts.php combines JavaScript files into a single request. In 2018 it was shown that an attacker can request all files through it at once, repeatedly, exhausting CPU and memory and taking the site down (a denial of service). WordPress did not change this behaviour, so protection belongs on the server or firewall, and it is enabled on Hyyat Host servers.

![Many JavaScript file requests passing through a shield before reaching the server](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-script-dos.webp)

## What is the vulnerability?

To speed up the dashboard, WordPress uses `load-scripts.php` and `load-styles.php` to merge several files into one request. The problem is that both files work **without logging in** and accept the list of files from the URL itself.

In February 2018, researcher Barak Tawily published that a single request can ask for dozens of files at once, and that repeating it quickly pushes CPU and memory to the limit. The flaw was registered as **CVE-2018-6389**.

## Why is it dangerous?

  *1***No complex tools needed**A simple tool on one machine is enough to send many requests. *2***Drains resources fast**Each request forces the server to read and merge dozens of files. *3***Hurts the neighbours**On servers without isolation, other sites go down too.

## Why did WordPress not fix it?

The WordPress team considered denial of service attacks a matter for the server and network, not the application, so no change was released. The right fix is in the hosting or the firewall, not in WordPress files.

## How to protect your site

1. **On Hyyat Host hosting:** Protection is enabled. The server checks whether the request comes from a user logged into WordPress, allows it, and blocks suspicious repeated requests.
2. **On your own server:** Add a web application firewall rule that blocks long requests to these two files from visitors who are not logged in, and limit requests per address.
3. **With Cloudflare:** Rate limit the `/wp-admin/load-scripts.php` path, or turn on [Under Attack mode](https://www.hyyat.com/en/knowledgebase/cloudflare-under-attack-mode/) during an attack.

 **Do not delete the file:** removing load-scripts.php breaks the WordPress dashboard, and the file comes back with the next update.

## How Hyyat Host protects your site

- Server rules allow load-scripts.php requests for logged-in users only and block suspicious ones.
- **Imunify360**, **ModSecurity** rules and **CSF** limit repeated requests from the same address.
- Account isolation with **CloudLinux** keeps an attack on another site from taking yours down.

Learn more about [Hyyat Host DoS protection](https://www.hyyat.com/en/dos-detection/).

## Frequently asked questions

   Is my site exposed right now?

The file exists on every WordPress site. If your site is hosted with Hyyat Host, protection is enabled on the server side.

   Does the flaw steal my data?

No. It is a denial of service flaw: it slows or stops the site, but gives the attacker no access to the site or its data.

   Is a WordPress security plugin enough?

Not on its own, because the request uses resources before the plugin runs. Effective protection lives on the server or the network.

   **Related guides**

- [What is a Slowloris DDoS attack?](https://www.hyyat.com/en/knowledgebase/what-is-a-slowloris-ddos-attack/)
- [Hacking Tools: C99 Shell](https://www.hyyat.com/en/knowledgebase/hacking-tools-c99-shell/)
- [How to Keep Your Website Secure: Practical Tips to Prevent Hacking](https://www.hyyat.com/en/knowledgebase/protect-website-from-hacking/)
- [Brute Force Protection: What It Is and How Hyyat Host Protects Your Site](https://www.hyyat.com/en/knowledgebase/brute-force-protection/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[WordPress Hosting](https://www.hyyat.com/en/wordpress-hosting/)[WordPress design](https://www.hyyat.com/en/wordpress/)