This week we've seen an increase in unauthorized access attempts to servers, websites, and emails. Although the attacks have been blocked by our security system, it's important to understand what's happening and how you can protect your website or online store. In this newsletter, we explain it clearly, without alarmism or technical jargon, and we give you the tools to be prepared.
What we've seen in SWPanel
This week we've blocked 176,685 unauthorized access attempts, which is a +9% increase compared to the average of the previous five weeks. This means that attackers are increasing their activity, especially in terms of WordPress and SSH attacks.
- WordPress has been the main target, with 69.6% of the blocks. This means that more than 2/3 of the unauthorized access attempts have been directed at the WordPress login page (wp-login.php) or the xmlrpc.php file, which are used to manage automatic updates and RSS feeds.
- SSH has increased by +56% compared to the previous week. This indicates that attackers are trying to access servers via terminal connections, testing millions of passwords.
- Email (SMTP) has also increased by +23%. This suggests that they are trying to access email accounts to send spam or steal information.
- FTP has seen a very noticeable increase: +208%. This is concerning, as FTP is an older and less secure protocol than SFTP, and is often used to upload files to websites.
- MySQL has also increased by +24%, which indicates that they are trying to access WordPress or other application databases.
- Lastly, web scanners have decreased by 6%, which could mean that attackers are focusing more on specific attacks than on general scans.
And in SWPanel, what does that mean for you?
In SWPanel, these access attempts have been automatically blocked by our firewall and attack detection system (fail2ban). This means that no attack has reached your website or servers. However, it's important that you understand why these attacks happen and what you can do to protect yourself better.
How we got here
The evolution of the blocks in the last 6 weeks has been as follows:
| Week | Blocks | Variation | Notes |
|------|--------|-----------|--------|
| 13/09 to 19/09 | 174,350 | - | Initial maximum |
| 20/09 to 26/09 | 157,108 | -9.9% | Noticeable drop |
| 27/09 to 03/10 | 147,984 | -5.8% | Minimum of the 6 weeks |
| 04/10 to 10/10 | 172,858 | +16.8% | Strong increase |
| 11/10 to 17/10 | 158,238 | -8.5% | Drops again |
| 18/10 to 24/10 | 176,685 | +11.7% | Maximum peak and end of the week
The average of the previous 5 weeks was 162,108 blocks per week, and this week we exceeded that average with 176,685 blocks, a +9% increase.
The overall trend is stable, with ups and downs, but without sustained growth. However, last week was the highest of the 6 weeks, suggesting that attackers are increasing their activity.
What's happening behind the numbers
Attackers are using automated bots that test millions of username and password combinations to access websites, servers, and emails. These bots are not humans, but programs that work 24/7, testing credentials that have been stolen from other platforms or that are generated randomly.
The increase in WordPress and SSH attacks suggests that they are looking for websites with weak passwords or outdated plugins. The increase in FTP attacks is also concerning, as FTP does not encrypt the connection or credentials, making it easier for attackers to intercept them.
The increase in email (SMTP) attacks may mean that they are looking for accounts to send spam or steal sensitive information. And the increase in database (MySQL) attacks suggests that they are trying to access information stored on websites.
What we can expect
The linear projection indicates that next week we could see a 4.6% decrease, bringing us to around 168,531 blocks. This doesn't mean that attacks will disappear, but it does suggest that the current trend indicates a stabilization or slight decrease.
Optimistic scenario:
- If the trend continues, attacks could stabilize or even decrease.
- Attackers could focus on other platforms or services.
- We could see fewer attacks on WordPress and more on other CMS or services.
Pessimistic scenario:
- If attackers increase their activity, we could see more attacks on WordPress, SSH, and emails.
- There could be an increase in attacks on websites with outdated plugins or unsupported versions.
- There could be more attacks on servers with weak passwords or insecure configurations.
Warning signs to watch for:
- A sustained increase in WordPress attacks, especially if they target specific plugins or versions.
- An increase in email or database attacks.
- An increase in attacks on servers with weak passwords or insecure configurations.
How it could affect your website or business
Although the attacks have been blocked, if you don't take action, you could face:
- Website downtime or slowness: If an attack manages to get in, it could crash your website or make it inaccessible to your customers.
- Data theft: If an attacker gains access to your database, they could steal customer information, addresses, emails, or even payment data.
- Email marked as spam: If an attacker gains access to your email account, they could use it to send spam, which could cause your future emails to go to spam or even have your domain blocked.
- Loss of Google ranking: If your website is hacked, Google could penalize it or even remove it from search results.
- GDPR fines: If customer data is stolen and you don't have adequate security measures, you could face fines for not complying with data protection regulations.
- Loss of time and money: If your website is hacked, you'll have to invest time and money in recovering it, notifying customers, and possibly hiring technical help.
How to protect yourself and prevent attacks
- Use strong and unique passwords: A weak password is the most common entry point for attackers. Use long passwords with uppercase and lowercase letters, numbers, and symbols, and don't reuse them on other accounts.
- Enable two-factor authentication (2FA): 2FA adds an extra layer of security, requiring an additional code (e.g., from an app or via SMS) to access your account.
- Update WordPress, plugins, and themes regularly: Updates often include security patches. If your website isn't updated, it's more vulnerable to attacks.
- Use a username different from "admin": Attackers often try the username "admin" first. Use a unique and hard-to-guess username.
- Limit the number of login attempts: Configure your website to temporarily block accounts after several failed login attempts.
- Use a web firewall: A web firewall filters attacks before they reach your website. In SWPanel, you can use our firewall to block common attacks.
- Use SFTP instead of FTP: The SFTP protocol encrypts the connection and credentials, making it more secure than FTP.
- Use a security scanner: A security scanner can detect vulnerabilities in your website, such as unsupported plugins or versions. In SWPanel, you can use the 360 Security analysis to review your website.
- Make regular backups: If your website is hacked, backups allow you to restore it quickly. In SWPanel, you can schedule automatic backups.
- Monitor security alerts: Subscribe to SWPanel's security alerts to stay informed about new vulnerabilities and how they affect your website.
What SWPanel tools can help you
- 360 Security analysis: Detects CMS, plugins, and versions with known vulnerabilities and marks your website in the panel. Use it to review your website and see if there are pending updates.
- 360 Security alerts: Warn you when a vulnerability affects you. Use them to stay informed about new risks and act before they affect you.
- BotLock: Controls and blocks malicious bots and crawlers from your website. Use it if you see a suspicious increase in traffic or if your website is frequently attacked.
- FireWall: Filters web attacks before they reach your application. Use it to block common attacks like brute force, SQL injection, or XSS.
- CMS auto-update: If you installed your website from SWPanel, you can enable automatic updates for WordPress, ensuring you're always using the most secure version.
- Backups: If your website is hacked, backups allow you to restore it quickly. Use them to schedule automatic backups and always have a clean version of your website.
- PHP version change: If your website uses an unsupported PHP version, you can switch to a supported version from the panel. Use it if you see that your website is vulnerable to security flaws.
- Ticket support: If you have questions or need help, you can contact our support via ticket. Use it if you don't know how to configure a tool or if you need help with an attack.
Quick summary
- This week we've blocked 9% more unauthorized access attempts than the average of the previous five weeks.
- Attacks are mainly directed at WordPress, SSH, and emails.
- Attacks have been blocked by our security system, but it's important that you take action to protect yourself better.
- Use strong passwords, update your website, enable 2FA, and use SWPanel tools to be prepared.
Sources
The data for this week has been measured by us on the SWPanel platform.
