Last week, server attacks decreased by 23% compared to the previous one. This is a relief, but it doesn't mean the danger has disappeared. Attackers are still trying to access WordPress, SSH, email, and other services, and although the SWPanel firewall blocks them, it's important to understand why this happens and how to protect yourself.
What we've seen in SWPanel
This week, the number of unauthorized access attempts has been 134,543 blocks, compared to 174,395 the previous week. This represents a 23% decrease. Although it's a significant drop, it's important to note that the average of the previous five weeks was 160,580 blocks per week, so this week is still below that average.
Of the blocks, 60.8% were attempts to access WordPress (via wp-login and xmlrpc), 21.4% to SSH, 7.6% to email services (SMTP), 5.9% to MySQL, and 3% to other services like IMAP, POP, or web scanners.
As for the countries of origin, 18.3% of the attacks came from the United States, followed by India (7.5%), Turkey (6.5%), and Iran (6.1%).
And in SWPanel, what's happening?
SWPanel has been actively monitoring these access attempts and has automatically blocked all suspicious connections through the firewall and the attack detection system (fail2ban). This means that customers haven't had to worry about these attempts, as the system has acted on their behalf.
How we got here
The evolution of blocks in the last 6 weeks has been as follows:
- 20/09 to 26/09: 155,255 blocks
- 27/09 to 03/10: 146,265 blocks (-5.8%)
- 04/10 to 10/10: 170,774 blocks (+16.8%)
- 11/10 to 17/10: 156,213 blocks (-8.5%)
- 18/10 to 24/10: 174,395 blocks (+11.6%)
- 25/10 to 31/10 (this week): 134,543 blocks (-22.9%)
This week has been the lowest of the last 6, with a 22.9% decrease compared to the previous one. The peak was recorded between October 18 and 24, with 174,395 blocks, while the current minimum is 134,543 blocks.
What's happening behind the numbers
The attacks are still mainly of the brute force type, where automated bots try to access WordPress, SSH, or email by testing millions of passwords. Although the volume has decreased this week, it doesn't mean attackers have given up: they're simply changing strategies or waiting for new vulnerabilities.
The 33% decrease in WordPress attacks is a positive sign, but the 31% increase in SSH attacks is a warning. SSH is the remote access to servers, so a successful attack could allow the attacker to take full control of the server.
What we can expect
If the trend continues, it's likely we'll see a 13.6% increase in blocks next week, bringing us to an estimated 152,868 blocks. This doesn't necessarily mean an increase in the threat, but rather a possible stabilization of the activity.
Optimistic scenario: attacks continue to decrease and remain below average. This could be because attackers are focusing on other targets or because the blocking systems are working well.
Pessimistic scenario: attacks increase again, especially in critical services like SSH or MySQL. This could be due to the publication of new vulnerabilities or increased automation of attacks.
Signs to watch: a sustained increase in SSH attacks, a resurgence in WordPress attacks, or the emergence of new types of attacks (such as API or database service attacks).
How it can affect your website or business
Even though attacks are blocked, it doesn't mean they can't cause damage if access is gained. For example:
- An online store with an outdated WordPress and weak passwords: if an attacker gains access, they could modify products, steal customer data, or even take down the website. This could mean lost sales, reputational damage, and potential fines for GDPR non-compliance.
- A company email with compromised credentials: if an attacker gains access to the email, they could send phishing emails to customers or employees, which could lead to loss of trust or even a more serious cyberattack.
- A website with outdated plugins: if a plugin has a known vulnerability and isn't updated, an attacker could exploit it to inject malicious code or redirect visitors to phishing pages.
How to protect yourself and prevent attacks
- Use strong, unique passwords for each service. A weak or reused password is like leaving your house door unlocked.
- Enable two-factor authentication (2FA). It's like having a security guard who asks for a second key before letting you in.
- Update WordPress, plugins, and themes regularly. Updates often include security patches that close loopholes.
- Use a web firewall and limit access attempts. This helps block bots before they reach your website.
- Set up automatic IP blocking. If an IP tries to access many times, it gets automatically blocked.
- Avoid using default credentials. Many attacks use combinations like "admin/admin" or "root/toor". Changing these credentials is a basic but effective step.
- Use HTTPS and SSL certificates. This protects communications between the user and the website, like a lock on a safe.
- Make regular backups. In case of a successful attack, you'll be able to recover your website easily.
- Monitor SWPanel security alerts. These alert you when new vulnerabilities appear that could affect you.
- Use security analysis tools. These help detect if your website has plugins or versions with known issues.
What SWPanel tools can help you
- Security Analysis in Security 360: helps detect if your website has CMS, plugins, or versions with known issues. It's like a security scanner that checks your website periodically.
- Security Bulletin and Alerts in Security 360: alerts you when a flaw appears that could affect you. It's like having a friend who calls you when there's a storm.
- BotLock: controls and blocks malicious bots and crawlers from your website. It's like a guard who watches the visitors and blocks those who aren't welcome.
- FireWall: filters web attacks before they reach your application. It's like a wall that prevents cars from crashing into your house.
- CMS automatic update: if you installed your website from SWPanel, you can activate automatic updates for WordPress and plugins. This ensures you're always protected against the latest flaws.
- Backups: allow you to recover your website in case of a successful attack. It's like having a backup in case something goes wrong.
- PHP version change: if you're using an unsupported version, you can switch to a supported one from the panel. This ensures you receive security patches.
- Ticket support: if you have questions or need help, you can contact the SWPanel security team. It's like having a trusted technician you can call.
Quick summary
- Attacks have decreased this week, but they're still active.
- WordPress and SSH attacks are the most frequent.
- Monitoring and updates are key to preventing damage.
- SWPanel automatically blocks attacks, but it's important that you also take measures.
Sources
The data for this week has been measured directly by SWPanel on the hosting and server platform.
