Control bots and attacks: a practical guide to protect your website

Today, your website not only needs to work well, but also to be secure. And one of the most common threats is not a hacker with a keyboard, but a bot: an automated program that can try to get in, steal data, or even bring down your site. Why should you care now? Because we already know that 23.2% of the traffic on websites with BotLock are AI bots and 9.9% are bots trying to steal information. It's not a distant problem: it's real, and it can affect you. But don't worry: with a few simple steps, you can protect your website as if you had a security guard who only lets the good guests in.

The idea in a nutshell

Imagine your website is a building with a main door. Bots are like people trying to enter with a thousand different keys, one after another, to see if any of them work. That's called "brute force" and it's one of the most common attack methods. 23.2% of visitors to websites with BotLock are AI bots, which are not malicious, but do consume resources. 9.9% are bots trying to steal information, like email addresses, passwords, or customer data. If you don't control them, they can slow down your website, steal information, or even bring it down. And that's not just a technical problem: it can affect your business, your reputation, and your peace of mind.

What could happen if you don't do it

Imagine you have an online store with WordPress and a plugin you haven't updated. A brute-force bot tries to get into the admin panel by testing millions of username and password combinations. Eventually, it gets in with a password you also use on another site. Once inside, it steals customer data like names, addresses, and credit card numbers. Then, that data is sold on the dark web and you get fined for not protecting your users' privacy. On top of that, your website gets filled with fake medicine ads because the attacker has installed malware. Your store goes down, you lose sales, and your name becomes associated with an unsafe site. This isn't a movie: it's happened, and it can happen to you if you don't take action.

The steps

1. Activate BotLock: BotLock is like a security guard who decides who enters your website. You can allow only the bots you need, like Google or Bing, and block those trying to steal information. If you have BotLock active, you're already one step ahead.
2. Use a FireWall: The FireWall is like an entrance door with a metal detector. Before an attack reaches your website, the FireWall filters it and blocks it. It's especially useful if your website has plugins or versions that aren't up to date.
3. Limit access to the website dashboard: The website dashboard (like wp-admin in WordPress) is where you manage everything. If you don't limit access, anyone who finds it can try to get in. You can restrict access by IP or use two-factor authentication (2FA), which is like having a key and a security code.
4. Don't block search engines: Google, Bing, and other search engines are bots, but they're good ones. Don't block them, but do control their access. For example, limit how often they crawl your website so they don't overload it.
5. Update CMS and plugins: If you installed your website from SWPanel, you can activate automatic updates. If not, do it manually. Updates usually include security patches. If your website has an unsupported plugin, it's like having a door with a broken lock.
6. Use backups: If something goes wrong, backups let you recover your website. SWPanel allows you to make automatic backups, but you can also do them manually. It's like having a spare key in a safe place.
7. Switch to a supported PHP version: If your website uses an unsupported PHP version, it won't receive security patches. From the hosting panel, you can switch to a supported version. It's like replacing an old, unsafe lock with a new, secure one.

How SWPanel helps you

SWPanel offers several tools to protect your website:

• Security 360: Analyzes your website and detects CMS, plugins, and versions with known vulnerabilities. If your website has an unsupported plugin, it will be marked directly in the panel.
• BotLock: Controls and blocks malicious bots and crawlers. You can allow only the bots you need and block the rest.
• FireWall: Filters web attacks before they reach your application. It's especially useful if your website has plugins or versions that aren't up to date.
• Automatic CMS updates: If you installed your website from SWPanel, you can activate automatic updates. This helps you keep your website secure without having to do it manually.
• Backups: Allow you to recover your website if something goes wrong. You can make automatic or manual backups.
• PHP version change: From the hosting panel, you can switch to a supported PHP version. This helps you keep your website secure and up to date.

Common mistakes

1. Not using two-factor authentication (2FA): 2FA is like having a key and a security code. If you don't use it, it's easier for someone to get into your website.
2. Not updating plugins and CMS: Unsupported plugins and CMS are like doors with broken locks. If you don't update them, they can be exploited by attackers.
3. Blocking search engines: Google, Bing, and other search engines are bots, but they're good ones. If you block them, your website could lose visibility in search results.
4. Not using FireWall: The FireWall is like an entrance door with a metal detector. If you don't use it, it's easier for an attack to reach your website.

Sources

The figures in this article come from traffic analysis of websites with BotLock and the security analysis from SWPanel.