More attacks blocked in SWPanel: what it means and how to protect yourself

This week, more attacks, more protection

This week we've seen a 45% increase in the number of attacker IPs blocked, and a 27% increase in distinct IPs. Although total blocks are 8% less than the average of the last five weeks, the increase in certain types of attacks is concerning. If you're selling online, managing corporate email, or maintaining a website, it's important that you understand what's happening and how to protect yourself.

What we've seen in SWPanel

This week we've blocked 134,975 unauthorized access attempts, which is a +45% increase compared to the previous week. These attempts include attacks on WordPress, SSH, MySQL, email, and other services. Below, we explain what each of these numbers means:

• 134,975 blocks: these are unauthorized access attempts that have been stopped by our automatic firewall (fail2ban). This means someone tried to access your website, your database, or your server, but failed.
• 21,295 distinct IPs: that is, 21,295 different internet addresses tried to access our servers. This is a +27% increase compared to the previous week. Each of these IPs tried, for example, to guess passwords or find vulnerabilities in WordPress.
• 27.2% of the blocks were against WordPress: this includes attempts to access wp-login.php and xmlrpc.php. WordPress is the most used content management system (CMS) in the world, so it's a frequent target.
• 51.1% of the blocks were against other services: this includes attempts to access databases, email servers, FTP, etc. An increase of +28640% compared to the previous week is a very notable change. This suggests that attackers are diversifying their strategies.
• 5.3% of the blocks were against SSH: SSH is the protocol we use to manage servers securely. A decrease of -62% compared to the previous week is a relief, but it doesn't mean we shouldn't stay alert.
• 6.3% of the blocks were against email (SMTP): this includes attempts to guess email account passwords. An increase of +26% is concerning, as it could mean attackers are trying to steal email addresses.

And in SWPanel, what?

In SWPanel, these attacks are automatically detected and blocked by our firewall and security systems. They haven't reached any website or customer server. However, it's important that website and online store owners understand that these attacks are a constant reality and that, if no measures are taken, they could have real consequences.

How we got here

In the last six weeks, the number of blocks has fluctuated quite a bit. Here's an overview:

• 01/10 to 07/10: 148,170 blocks
• 08/10 to 14/10: 164,007 blocks (+10.7%)
• 15/10 to 21/10: 164,229 blocks (+0.1%)
• 22/10 to 28/10: 164,481 blocks (+0.2%)
• 29/10 to 04/11: 93,143 blocks (-43.4%)
• 05/11 to 11/11 (this week): 134,975 blocks (+44.9%)

Last week was the lowest of the six, with just 93,143 blocks. This week, the number has risen again, although it's still 8% less than the average of the previous five weeks. The historical maximum in this period was 164,481 blocks, and the minimum was 93,143.

What's happening behind the numbers

Attackers are automated bots trying to guess passwords, find WordPress vulnerabilities, or access servers. Many of them are part of automated campaigns that scan millions of IP addresses for vulnerabilities. Others are part of gangs that sell stolen access in dark markets.

The increase in attacks on other services (51.1%) suggests that attackers are diversifying their strategies. This could be because certain WordPress attack methods have become less effective, or because they're looking for new ways in.

The decrease in SSH attacks is positive, but it doesn't mean attackers have abandoned this type of attack. It could mean they've changed strategy or are focusing on other targets.

What we can expect

If the trend continues, it's likely that the number of blocks will continue to fluctuate, but with a general downward trend. A linear projection suggests we could see around 117,003 blocks next week, which would be a -13.3% compared to this week.

Optimistic scenario: the number of blocks continues to decrease and attacks become less frequent. This could be because attackers are changing targets or security systems are improving.

Pessimistic scenario: the number of blocks increases again, which could mean attackers are using new methods or there's a recently published vulnerability being exploited.

Warning signs to watch for: a sudden increase in WordPress attacks, an increase in database attacks, or an increase in email attacks. If you see any of these signs, it's important to review your website and take preventive measures.

How it can affect your website or business

Although the attacks have been blocked, it doesn't mean they can't have real consequences. Here are some possible scenarios:

• Website down or slow: if an attack manages to get in, it could overload your server and make your website stop working. This means your customers won't be able to access your online store, which could mean lost sales.
• Customer data theft: if an attacker manages to access your database, they could steal email addresses, credit card numbers, or personal data. This could not only result in fines for GDPR violations, but also a loss of customer trust.
• Email marked as spam: if an attacker manages to access your email account, they could send unsolicited emails from your name. This could cause your real emails to be marked as spam, affecting your reputation and sales.
• Loss of Google ranking: if an attack manages to inject malicious content into your website, Google could penalize your site and lower its position in search results. This means less traffic and fewer sales.
• Lost workdays: if your website is affected by an attack, you could lose days of work trying to recover it, which could mean a direct financial impact.

How to protect yourself and prevent attacks

Here are some measures you can take to protect yourself:

1. Use strong and unique passwords: a weak or reused password can be easily guessed. Use long passwords with numbers, uppercase and lowercase letters, and avoid using the same password on multiple sites.
2. Enable two-factor authentication (2FA): this adds an extra layer of security. Even if someone guesses your password, they won't be able to access without the second factor (like a verification code).
3. Update WordPress, plugins, and themes regularly: security flaws are usually fixed in updates. If your website isn't updated, it's more vulnerable to attacks.
4. Use a web application firewall (WAF): a web firewall filters attacks before they reach your application. In SWPanel, you can use our FireWall to block common attacks.
5. Limit the number of login attempts: if someone tries to access your website with the wrong password multiple times, you should block them. You can use WordPress plugins or configure your server to do this.
6. Use regular security scans: the website security analysis in Seguridad 360 can detect CMS, plugins, and versions with known vulnerabilities. It helps you identify problems before they're exploited.
7. Enable automatic backups: if your website is affected by an attack, backups allow you to recover it quickly. In SWPanel, you can activate backups from the panel.
8. Review access permissions: make sure only the people who need access have permission. If someone no longer works with you, revoke their access immediately.
9. Use a bot blocking service: BotLock can help you control and block malicious bots and crawlers trying to access your website.
10. Subscribe to the SWPanel Security Bulletin: it will keep you informed about new vulnerabilities and how to protect yourself. You can also activate Seguridad 360 security alerts to notify you when a vulnerability affects you.

What SWPanel tools can help you

SWPanel offers several tools that can help you protect yourself:

• Website security analysis in Seguridad 360: detects CMS, plugins, and versions with known vulnerabilities. It helps you identify problems before they're exploited.
• Security bulletin and alerts in Seguridad 360: warn you when a vulnerability affects you. They keep you informed about the latest risks.
• BotLock: controls and blocks malicious bots and crawlers from your website. It's especially useful if your website receives many unauthorized access attempts.
• FireWall: filters web attacks before they reach your application. It's an additional layer of security that can block common attacks.
• Automatic CMS updates for websites installed from SWPanel: if you installed your website from SWPanel, you can activate automatic updates to keep WordPress, plugins, and themes up to date.
• Backups: if your website is affected by an attack, backups allow you to recover it quickly. You can activate backups from the panel.
• PHP version change from the hosting service: if your website uses an unsupported PHP version, you can switch to a supported version from the panel. This is important because unsupported versions don't receive security patches.
• Ticket support: if you have questions or need help, you can contact our support via ticket. We're here to help you.

Quick summary

• Attacks are increasing, but they're blocked by our firewall.
• The most frequent attacks are against WordPress, email, and other services.
• The most effective measures are using strong passwords, 2FA, updates, and a web firewall.
• SWPanel offers tools that help you protect yourself, such as FireWall, BotLock, and security analysis.

Sources

The data for this week has been measured directly by SWPanel on our hosting platform and servers.