My web site is under attack

Diggs

Well-Known Member
Reaction score
3,430
Location
Wisconsin
I'm getting notices that my old business Wordpress site login is under attack. After twelve tries for a login the IP was banned for 20 minutes. Now after 16 failed tries the IP was banned for 24 hours. The IP being used (109.248.175.214) is from Russia but that provider also hosts VPN traffic so the true source could be from anywhere. My site is just a page saying I'm closed so I'm not too worried about it. Is there anything else I should be doing?

@add - I did block the IP in cPanel.
 
Last edited:
What else should you be doing?

NOT USING WORDPRESS!

Every single wordpress install on the planet is going to get hacked and defaced... period... end of sentence. If you can't get off wordpress then you need to protect it. A cloudflare proxy is a good place to start, though you'll have to pay them if you want to do specific ACLs on the admin section.

Everything has gone static for a reason...
 
There are plugins for Wordpress that can convert the existing site to static so you can publish that too.

I had that going for mywebsite for awhile, an offline wordpress dev site that I'd export and push into the public server.
 
Use Cloudflare and CleanTalk. It will literally block 99.997% of bots, spam comments, and spam registrations. Using Wordpress unprotected nowadays is like browsing porn and torrent websites in the Windows XP days using Internet Explorer 6 and Limewire without an antivirus on an emachines from the 90's. Not a pleasant experience.
 
If you only have a single webpage consider using Amazon Web Services' Free Tier.

My tiny website has been hosted there ever since I started, and they're quite well "armored up."
 
I would remove everything from your site and just host a static html page that you are closed. No WordPress to exploit then.
Perfect! Just the answer I was looking for. Thanks!

If you only have a single webpage consider using Amazon Web Services' Free Tier.

My tiny website has been hosted there ever since I started, and they're quite well "armored up."
I've got other things there too so that won't be an option. The business site was the only thing that uses Wordpress.
 
I'm currently using Hugo to generate a site, with content code stored in github, and linked to a Cloudflare Pages site that generates content automatically based on what's in GIT.

So I push to GIT and tomorrow the site is updated. Or I can force an update if I want.

$0 for all of that.
 
I think we're being a bit hyperbolic about the whole ordeal, but yes, as the OP asked - the answer is to host a static, non-wordpress html file saying "We're Closed", as has been mentioned.

I would stress to the OP that it is important to block countries like Russia, China, Koreas on your hosting service or Worpress (Either works just as well) - If there is virtually no chance of someone in a respective country visiting or purchasing from you then they don't need access to your site. I block Russia, France, much of Africa, etc...

There are some important things to think about:

First, I would point out that Wordpress DID in fact stop the attack after a very short time - as designed. If the same IP was to keep hammering - it would have got another ban for 24-36 hours... how long is it going to take to brute force a website 10-20 passwords per day? Literally forever.

1. Wordpress is only as good as its updates (and plugins) - leave a site sitting un-patched, and yeah, you're going to have issues. So, leave it on the default auto-update setting and get site-update notifications to warn of failures and issues.

2. Static pages can't be used for eCommerce or Membership sites. So no, not "everyone is going to static" websites. People that can, should.. but most of the net is dynamic and is increasingly so, not less.

3. There is nothing special about "static" websites/pages - it's how the web started. There are numerous plugins for Wordpress that will allow you to turn your whole "dynamic" site into, and serve, static webpages - problem solved.. right in Wordpress. The good thing is that you can still edit your site as usual - then generate the static pages/changes. All that to say, Wordpress has done "static" forever... Hugo looks cool, but it's not bringing anything particularly new except for how it's sourcing some of it's dependencies. But let's get real, not everyone has time to learn a new language (Go) and new set of Functions(Hugo) and use a text editor to build an entire site that would equate to something substantial.

Wordpress makes up the majority of CMS web systems, far greater than any other one - and their market share has increased over the past years, not decreased. Yet, we're not seeing 450M sites down and defaced now, are we? In the same vein, it would be easy enough for an attacker to attack the hosting service's login, to your account - and deface it from there - Static pages or not.

Like Windows or OSX/iOS - for the most part, "The System" is pretty secure. It's the 3rd-party software that gives much of the vulnerabilities. Wordpress plugins should be well known and well-used and well supported and updated. Avoid the cheap or free options, as a business.

And like anything else, Password complexity, 2FA, IP/Region Blocking, etc.. all things that the user needs to setup - Wordpress isn't "your server" or your hand-holding mommy... and as with most specialized things, like a Website, ignorance gets most people in trouble when their site gets defaced or hacked.

ADD: Also, I don't worry about my websites... they have rolling backups to Cloud and local backup sets. Something gets hacked.. the first thing I do is contact the hosting company and they can usually "roll it back" - but if not, I can simply restore the entire Wordpress site from a weekly backup. Prudence. Problem Solved.
 
Last edited:
Blocking foreign nations does nothing... it's literally a feel good measure only. Most attacks on US sites come from the US. Most attacks on a Canadian site comes from... the US. Blocking the handful from CA and RU? Whatever... just droplets from the stream.

As for the rest, you've missed the boat. Static sites are CDN friendly, and easiest to move into a pure cloud setting. All the server side stuff moved into micro services.

What does all this mean? It means all that security crap you just talked about? Yeah... GONE.. USELESS... OLD DATA. Static sites require ZERO security. All they need is their content folders set to read only. An agent on the server reworks those files regularly via continuous integration processes. Setup is controlled via a cloud surface you can MFA.

The micro services? Those require security, and usually are done so via API key. The result is a vastly more reliable reality because those micro services are themselves running as containers somewhere.

Static Sites are the future, they are where you get infinite scale, near perfect security, AND the best cost controls. And I mean that infinite bit, you can grow from SMB to Fortune 500 on a static site. You're not coming close to that on Wordpress.

Not to mention the static site renders orders of magnitude faster, which means better page ranks.

So by all means, everyone please... continue to use Wordpress! PLEASE! Your slow crap sites will get demoted in the search engines and those of us actually looking at the future will take the traffic and the business. It's your funeral.

By the way point 2? COMPLETELY WRONG. Yes, you CAN use static sites for ecommerce pages. And doing so makes your PCI compliance scans MUCH easier because they aren't aimed at you, they're aimed at the payment provider. In many cases you don't even need to scan at all! (Google, Snipcart)

P.S. They make CMS systems that build the HUGO for you. I don't use one, but netlify exists for a reason.

P.P.S. Did I mention I'm paying $0 for my sites now... no hosting costs... anywhere... ever.
 
Last edited:
I used to manually code up my website using static HTML/CSS with custom PHP snippets for the header and footer so if I changed something in the header.php or footer.php page it would update across the entire website without having to edit each page manually. That being said, I need more than static HTML/CSS nowadays. I need to have an online store, especially now thanks to Coronavirus and everyone wanting to order online. I need a contact form. Too many people are reluctant to pick up the phone these days and they assume you don't accept text, so having a contact form is critical to getting these people's business. And yes, you can use a script to put a contact form on your static website, but then it isn't static anymore, is it?

Add to this the big pain in the butt that responsive design is and Wordpress is just so much easier. If you absolutely must use a static HTML/CSS website, then I recommend buying a template from themeforest.net. That way you don't have to worry about validating the site to work on all devices because the template already is. All I can say is good luck when you want to edit or add something to the website or if you want a contact form or the ability for people to buy on your website in the middle of a pandemic where Amazon is the #1 retailer. You're going backwards, not forward.

The only time I'd recommend a static website is if you have a very small business where you never need to update anything. Let's say you have a small tea bar business. Nobody is going to want to contact you with a contact form, you won't be selling online, and the only thing that needs to be updated is the PDF menu that you might update once or twice a year. Updating the PDF is easy. All you have to do is upload the new PDF via FTP. You never have to touch a line of code. This business is a good candidate for a static website.
 
- WordFence
- Strong username and password
- Good host

These are the three things you need to have a secure website. Everyone here talking about static sites and WordPress being horrible (and the business dying from it) is totally wrong. WordPress is king for a reason, and will be for the future. Build with WP and you're set. Build a static site, and you're gonna be seen as outdated, behind the times, and old.
 
Blocking foreign nations does nothing... it's literally a feel good measure only. Most attacks on US sites come from the US.
Well, that's not really true at all. Most "hacking" activity is performed via VPN (Or VPS - same idea) - of those VPN hackers, they tend to use exit nodes in countries that do not require the VPN to hold or keep logs - Russia, Koreas, Netherlands, Congo, Belize, Nigeria, etc.

Most attacks may come from the US (I would contend that is actually false, but anyways) but attackers would be stupid to use a US exit point - it's fully and wholly tracked by the US government. So, you block their shady exit points.. that's why blocking foreign nations is a worth-while thing to do. I have literal years of data between half a dozen websites that contradict your stance on geo-blocking.
As for the rest, you've missed the boat. Static sites are CDN friendly, and easiest to move into a pure cloud setting. All the server side stuff moved into micro services.
Right. I get it, I don't think it's a bad way to go, honestly. It's pretty interesting in fact. The problem is, you are attributing too much "ability" towards Hugo and Netlify - abilities which are "missing" and disbar it from CMS/Customer/account use.

Dynamic sites are "CDN Friendly", too.. kind of a non-point. CDN's were, after all, created in response to dynamic sites in the first place.

By the way point 2? COMPLETELY WRONG. Yes, you CAN use static sites for ecommerce pages. And doing so makes your PCI compliance scans MUCH easier because they aren't aimed at you, they're aimed at the payment provider. In many cases you don't even need to scan at all! (Google, Snipcart)
Funny, both Netlify and Hugo disagree with you both in their FAQs/About and their implementation and functions documentation. It can not be a CMS - per the horses mouth. That makes sense, to me.

The PCI compliance bit is exactly the same for Wordpress or any others that use an API - That same API that netlify uses for Square or Stripe is the exact same that is used by Woocommerce or virtually any other payment plugin.. so PCI compliance is still "pointed" at the payment provider. No loss nor gain either way you take it.

You can "sort of" use static pages as an eCommerce site, you're right! However, it still can't be used as a CMS - it still can't manage accounts or members/memberships.
So while you can sell an item from a static page - the completion of the sale happens on Square or Stripe, etc. The customer info is all gleaned from there, the order created, and you can check your payment gateway for a sale to fulfill.

Here's where that all falls apart:
1. No customer area or accounts - Recurring customers, offering discounts to "valued" customers, taking recurring payments, Offering subscription services. Follow up emails, forgot cart emails - all no good.
2. There is no customer area for customers to manage or track. They can't unsubscribe, they can't cancel orders, they can't pay bills, and they can't contact you in any other way than to have your "virtual host" send you a shitty POST email from a website form (That hopefully wont be blocked when Outlook picks it up lol - Domain issues reported here!).
3. There is no SEO feedback, there's no SEO dynamics.
4. There's no (seemingly) meaningful way of integrating Mailchimp, Constant Contact, et al.
5. No inventory management - once you sell something, you have to manually track it! You have to manually delete the static page/item when sold out.

All those things might be fine for a small boutique place that doesn't sell too much - but take a real-world example of a Winery I manage a website for... They sell hundreds of Wines and products everyday. Stock management has been critical as there are 9 people working, often at different venues at the same time and we need to know what "the business" has globally as to not cause anger, confusion and bad reviews from people that were falling through the cracks before we were tracking inventory (and stop refunding people! What a PITA!). They offer a Wine Club membership, "Cancel anytime!", on a recurring quarterly basis where not only is the payment automated, the order creation for each quarter is made, sent to the employee dashboards for fulfillment tracking - all while the customer is charged dynamically - tax, Fed Ex shipping price based on their location and an NCA(Non Cash Adjustment) fee where allowed.
The Winery also offers a percent discount on items in the store - but you MUST be logged in - there must be a way for the site to know whom to present the discounts!

None of this can be accomplished with a static site. SO, unless that changes, huge swaths of "businesses" are not going anywhere.


P.S. They make CMS systems that build the HUGO for you. I don't use one, but netlify exists for a reason.
No, they make CIS - Continuous Integration System - they specifically leave out anything regarding CMS - as per both their About pages.
P.P.S. Did I mention I'm paying $0 for my sites now... no hosting costs... anywhere... ever.
OK, that's great! Did I mention that each of my businesses that has a website (and I) basically gets to write-off the entirety of the Website as "Advertising"? So in reality, it's all basically free. IRS.
 
Last edited:
On a separate note, Netlifycms.org has a "Netlify" type of deal going on - to make up for the deficiencies in static websites - further proving the point that what you claim, is not true.

BUT it's "Static + content management" - so it has the very same attack surfaces you find so egregious.
 
@phaZed I saw a lot of words... and yet you didn't do the one thing I specifically said to do.

I don't like netlify for many reasons. But there are MANY CMS platforms that generate Hugo front matter, and they sit on top of your code editor and exist 100% offline. You have to know about as much "back end junk" to get all this working as you do on Wordpress. The only gap here is, you've sunk the time into dong things the hard way via Wordpress. That's a real thing, it's been around a long while.


These guys are the "big name" in making ecommerce sites static. And, it's not so much a traditional ecommerce site as it is a series of templates that integrate with their shopping system. It tracks sales and whatnot and does everything it does the same as my Big Commerce stuff ever did... all while being several orders of magnitude less expensive. It does ALL of the things you claim "aren't possible". And it does so on a 1% transaction basis, integrating the merchant processing too. So now the expense of running the site is buried in the sales items themselves, easily calculated. Though... admittedly if you get huge volume that could add up in a hurry.

Writing off costs on your taxes just means that much less profit in your pocket. You can justify that you'd have handed it to the IRS, and while that MIGHT be true... and I'm rather dubious about that I might add. Assuming that is true, then you're free to redirect those funds into something more productive. Liquidity matters.

Once you get your web content living in the CDN, you'll never go back. It simply scales way too well. The site will NEVER be slow, never needs backed up, never needs secured. I "backup" my stuff by keeping a local clone of the source in M365.

And to bring this back to where things started... your view of "hacking" is heavily distorted. The VPNs out of nation aren't used to attack domestic sites, they're being used the other way. But that doesn't really matter, because a publicly exposed asset is exactly that publicly exposed. Any attempt to maintain any sort of blacklist is security theater. If you want to see the attacks realtime? There are many maps, here's one of them: https://www.fireeye.com/cyber-map/threat-map.html. Nothing exposed publicly is safe as long as a user has a browser. Limiting access is silly, all geoblocking does is clean up filtration logs to domestic traffic.

You can jump through flaming hoops to make wordpress work, or you can adapt to be in the cloud properly. The latter is the future, make the leap or get left behind. Though I will admit... there's a TON of time on that. Wordpress has a massive ecosystem, and it in and of itself is evolving too. The plugins that push Wordpress into CDNs and export static content have come a LONG way in the last year alone. So now it's entirely possible to have an offline wordpress instance, publishing into a CDN just like my Hugo site does. And in doing so, you can keep the familiar tools. Though admittedly, you do still have to jump through some more hoops to get ecommerce online.

I did the offline wordpress thing years ago, abandoned it. Discovered I can edit a Hugo template faster, with less headache, and far less debugging. So now I do what I do. I don't expect many others to do that though, because it means learning how to do front end web yourself. That's non-trivial. But again, they make CMSs for that, and all sorts of places sell templates all predone and pretty. Again... it's like Wordpress, just not as large... yet.
 
Last edited:
What else should you be doing?

NOT USING WORDPRESS!

Every single wordpress install on the planet is going to get hacked and defaced... period... end of sentence. If you can't get off wordpress then you need to protect it. A cloudflare proxy is a good place to start, though you'll have to pay them if you want to do specific ACLs on the admin section.

Everything has gone static for a reason...
Another good reason that I use a flat file blog.

Rick
 
I would remove everything from your site and just host a static html page that you are closed. No WordPress to exploit then.
A few years ago, I had a similar problem with my website. It was constantly under attack, and I kept getting warnings about it. Trying to stop these attacks and keep up with security was really stressful. In the end, I decided to just shut down the site because it wasn't really needed anymore. It was hard to do, but I felt much better afterwards. ( PS It's impossible to post as a newbie, everyone for some reason don't consider newbies to be real people anymore.... )
 
Last edited:
Back
Top