This week, fewer attacks, but no less risk
Server attacks have dropped by 44% this week, which is good news. But it doesn't mean the dangers have disappeared. Every day, thousands of bots try to access WordPress, email accounts, databases, and servers using brute force. SWPanel's automatic firewall blocks them, but if you're not prepared, even one can cause serious problems.
Why should you care? Because if someone manages to get in, they can steal customer data, take down your website, or even use it to attack others. And that doesn't just affect your business—it also impacts your reputation and your peace of mind.
What we've seen in SWPanel
This week, the number of unauthorized access attempts has dropped to 93,593 blocks, compared to 165,876 the previous week. This represents a 44% reduction. Although it's a notable decline, the attacks remain active and in motion.
Of the blocks, 58.9% were against WordPress (attempts to access wp-login and xmlrpc), 20.2% against SSH, and 7.3% against email services. This means attackers are still focused on websites and admin accounts.
The countries with the most attacks were the United States (23.1%), Singapore (6.7%), France (6.5%), and Iran (6.3%). Although attacks come from all over the world, bots have no face or nationality: what matters is that they're out there and trying to exploit any weakness.
How we got here
The last 6 weeks have shown a clear downward trend, albeit with fluctuations. Here's the summary:
- 24/09 to 30/09: 144,977 blocks
- 01/10 to 07/10: 149,560 blocks (+3.2%)
- 08/10 to 14/10: 165,164 blocks (+10.4%)
- 15/10 to 21/10: 165,594 blocks (+0.3%)
- 22/10 to 28/10: 165,876 blocks (+0.2%)
- 29/10 to 04/11: 93,593 blocks (-43.6%)
The average of the previous 5 weeks was 158,234 blocks per week. This week, with 93,593, it's 40.9% below that average. The maximum of the 6 weeks was 165,876 blocks (week of 22/10 to 28/10), and the minimum is this very week.
What's happening behind the numbers
Attacks remain mostly automated: bots trying millions of username and password combinations, or looking for websites with outdated plugins or versions. What has changed this week is the frequency of these attempts, which could be due to a rotation of automated campaigns or a temporary reduction in activity from certain groups.
Although the number of blocks has dropped, it doesn't mean attackers are on vacation. Rather, it means they're reorganizing their strategies. And that's something we can't ignore.
What we can expect
If the trend continues, it's likely that the number of blocks will keep decreasing in the coming weeks. A linear projection suggests we could see around 126,706 blocks next week, which would be a 35.4% increase compared to this week. This doesn't mean attacks are increasing—it just means the drop this week is so significant that the comparison becomes more favorable.
Optimistic scenario: attacks continue to decrease, giving us time to strengthen security.
Pessimistic scenario: attackers change their strategy and increase pressure on other types of attacks (e.g., against less common plugins or outdated versions).
Signs to watch for: a sudden increase in blocks on less common services (like MySQL or IMAP), or a shift in the countries of origin of the attacks.
How it can affect your website or business
Imagine you have an online store using WordPress. If an attacker manages to get in via brute force, they could:
- Steal customer data: emails, addresses, credit card numbers. This not only affects your reputation but could also make you legally liable if you're not GDPR compliant.
- Take down your website: attackers can use scripts to crash your site, meaning lost sales and angry customers.
- Use your website to attack others: if they gain access, they can use your server to send spam or malware, which could get your domain blocked by email providers.
These scenarios aren't alarmist—they're real and have happened to others. What matters is being prepared.
How to protect yourself and prevent attacks
- Use strong passwords: a long password with uppercase, lowercase, numbers, and symbols. Don't reuse it on other sites.
- Enable two-factor authentication (2FA): adds an extra layer of security, even if someone guesses your password.
- Update WordPress, plugins, and themes regularly: updates often include security patches. If you installed WordPress via SWPanel, you can enable automatic updates.
- Use a web firewall: filters attacks before they reach your application. SWPanel has a FireWall you can activate.
- Limit access attempts: with tools like BotLock, you can block malicious bots and crawlers.
- Make frequent backups: if something goes wrong, you can quickly restore your website.
- Review user permissions: not everyone needs full access. If an employee leaves, remove their access.
- Use regular security scans: with Seguridad 360, you can detect CMS, plugins, and versions with known vulnerabilities.
- Keep PHP updated: if you're using an unsupported version, you won't receive patches. Switch to a supported version via the hosting panel.
- Subscribe to the SWPanel Security Bulletin: we notify you when new vulnerabilities could affect you.
Which SWPanel tools can help you
- Seguridad 360: analyzes your website and detects CMS, plugins, and versions with known vulnerabilities. Ideal for identifying problems before anyone else does.
- Security Bulletin and alerts: we inform you when new vulnerabilities could affect you. Ideal for staying up to date without wasting time searching.
- BotLock: controls and blocks malicious bots and crawlers. Ideal if your website receives many unauthorized access attempts.
- FireWall: filters web attacks before they reach your application. Ideal for protecting against automated attacks.
- CMS auto-updates: if you installed your website via SWPanel, you can enable automatic updates for WordPress, plugins, and themes.
- Backups: if something goes wrong, you can quickly restore your website.
- PHP version switch: if you're using an unsupported version, switch to a supported one via the hosting panel.
- Ticket support: if you have questions or need help, you can contact us anytime.
Quick summary
- Attacks have dropped 44% this week, but they're still active.
- The most common attacks are against WordPress, SSH, and email.
- Attacks remain automated, but they can still cause real damage.
- The best defense is a combination of good practices and security tools.
Sources
This week's data was measured directly by SWPanel's SOC on the hosting and cloud server platform.
