Magento 2
Watchlog PRO - Security enhancement for your Magento 2 website
The Watchlog Pro extension will allow you to list the IP addresses that try to access your Magento 2 back office, and to stop these intrusion attempts mainly by adding these IP addresses to a blacklist.
Possible brute force attack on Magento
Thousands of Magento websites are certainly concerned by this very large brute force attack which aim is clearly to force access to Magento back offices.
The principle of that kind of attack is simple: robots try to log into your back office using multiple login/password combinations until they find the correct credentials.
Once these credentials are identified, your Magento website becomes easy prey for hacking: exploitation of your database, diversion of your payments, hacking, unfair competition...
Several users have already reported some IPs.
What to do?
The login attempts can occur several times a minute and can reach several tens of thousands of attempts every day which will deeply threaten the security of your website as you can see on the screen below.
This is why it is important to protect your Magento 2 website against brute force attacks.
Check if your Magento 2 website is hacked
You can first install our free Watchlog extension for Magento 2 to detect the intrusions into your Magento 2 back office in order to track any login attempt.
You'll then be able to see all the login attempts made from your website on 2 graphs.
The detail of each login attempt will be displayed below these 2 graphs. You'll find the IP addresses, dates, logins, and passwords...
Bypass the attacks
Fortunately, these attacks are easy to bypass! Several solutions exist to make your back office invisible to robots that try to log in:
- Modify the name of your back office
- Activate captcha for your back office
- Restrict the access to your back office by IP with htaccess
You can also use the Watchlog Pro extension for Magento 2 that will act as a firewall and replace all the above steps.
The admin of Magento 2 can be concerned with these brute force attacks so you need to make sure to protect each entrance to your Magento 2 back office.
How to use Watchlog Pro for Magento 2?
The Watchlog Pro extension allows you to detect if your Magento 2 website is threatened by any possible brute force attack and it gives you the ability to protect your website against it. You can start using the extension very quickly following 3 simple steps.
STEP 1: Configure Watchlog Pro in a general way
To start configuring Watchlog Pro for Magento 2, go to:
StoresSettingsConfigurationWyomindWatchlog Pro
General Settings
In the General Settings tab, you'll be able to configure the lifetime of the history and activate the logs.
- History lifetime in days
Define a history lifetime in days. For example, you'll be able to define the history lifetime as 30 days in order to automatically purge the history of all the login attempts that are older than 30 days. - Enable Log
By activating that option, a log file will be generated in var/log.
Periodical Report
In the Periodical Report tab, you'll be able to configure the login reports:
- Send a periodical report
You can choose to receive periodical reports. If you enable the periodical reports, you'll have to configure the following options. - Period to report in days
Define how many days you want to include in your report. - Sender Email
Add the email address of the sender. - Sender Name
Add the name of the sender. - Send the reports to
Add the email addresses of the recipients separated by a comma. - Report title
Define a title for your report. - Report schedule
Define a schedule to automatically send the reports.
You'll then receive a periodical report as below.
White/Blacklist settings
Watchlog Pro gives you the possibility to create a whitelist as well as a blacklist of IPs. In the White/Blacklist settings tab, you can define your own parameters by filling in a certain number of fields:
- Whitelisted IPs
Click on Add IP to add an IP address to the whitelist.
You also have the possibility to add a Note that will be displayed in the login attempts grid.
- Secret key to whitelist your IP
If your own IP is blacklisted, you can use that secret key to whitelist it.
- Allow access to whitelisted IPs only
Choose to allow access to whitelisted IPs only. - Blacklisted IPs
Click on Add IP to add an IP address to the blacklist.
You can define an end date and hour for blocking the IP address.
You also have the possibility to add a Note that will be displayed in the login attempts grid. - Number of attempts before being blacklisted
Define a number of attempts before the IP is automatically blacklisted. - Blacklisted IPs blocked for X minutes
Choose to blacklist the IPs for a defined period of time. - Message to display if blocked
Define a message that will be displayed if someone with a blacklisted IP tries to log in to your admin panel.
Blocked IP Report
You'll be able to receive a report every time an IP address is blocked. For this, you can configure the report in the Blocked IP Report tab:
- Send a report when an IP is automatically blocked
Choose to receive a report when IPs are automatically blocked or not. By setting that parameter on YES, more options should display. - Sender Email
Fill in the email of the sender. - Sender Name
Add the name of the sender. - Send the reports to
Enter the email addresses of the recipients separated by a comma. - Report title
Define the name of your report.
STEP 2: Check the login attempts to your Magento 2 admin
To have an overview of the connection attempts to your Magento 2 back office, go to:
StoresWatchlogConnection attempts
Login attempts charts
On that page, you'll get 2 graphs that retrieve the login attempts statistics.
These graphs are based on 2 different periods of time in order to provide you with maximum information. The first chart will display the statistics in the last 30 days whereas the second one will sum up the login attempts in the last 24 hours.
Both graphs show 3 different curves:
- Success: login attempts that succeeded
- Blocked: login attempts that have been blocked
- Failed: login attempts that failed
If you hover the mouse over the different points of the curves, you'll get the detail of the number of connection attempts at a specific date.
Login attempts detailed grid
Below the 2 graphs, you should find the summary of the login attempts over the last days retrieved in a grid. The login attempts data are retrieved into specific columns:
- IP
The IP that tried to log into your Magento 2 back office. - Date
The date when the IP tried to log in. - Login
The login used. - Password
The password used to log in. - Message
The message displayed when trying to log in. - Url
The URL from which the IP tried to log in. - Status
The status of the IP (Success, Failed, or Blocked).
By clicking on any IP address, you'll be redirected to www.abuseipdb.com which will automatically check that address. This allows you to see in one click if the IP address has already been reported by other users.
You have the possibility to purge history by clicking on Purge history now and to send the report of the login attempts by clicking on Send the periodical report now.
Login attempts summarized grid
You can get a summarized view by clicking on Switch to the summarized view. From that new grid, you will get a table with the basic information:
- IP
The IPs that tried to log in - Last Attempts
The date of the last attempt - Attempts
The number of login attempts - Failed
The number of failed login attempts - Succeeded
The number of login attempts that succeeded - Blocked
The number of login attempts that have been blocked (these IP addresses won't have access to the Magento 2 admin login page) - Action
You can directly add these IP addresses to the white and blacklists
To remove an IP address from a list, simply click on Remove IP from the white/blacklist.
You will be able to see if you have already blacklisted or whitelisted some IP addresses. Indeed, they will be displayed in black or white boxes. In the case where an IP is whitelisted and blacklisted at the same time, the whitelist will always have the upper hand.
By default, both tables display data for the last 30 days. This can be easily modified in the History lifetime in days field, from :
StoresSystemConfigWyomindWatchlog
Note that to go back to the detailed view, you just have to click on Switch to the detailed view.
STEP 3: Manage traffic to your Magento 2 back office
With Watchlog Pro, you can easily control and manage the traffic to your Magento 2 admin. You have 2 possibilities for doing it:
- Whitelist IPs
- Blacklist IPs
Add IPs to the whitelist
You can add as many IP addresses as you want to the whitelist. For this, go to:
StoresSettingsConfigurationWyomindWatchlog Pro
In the White/Blacklist settings tab, look for the Whitelisted IPs option. To add an IP address to the whitelist, click on Add. Then in the IP field, simply enter the IP address you want to whitelist.
Note that you can use wildcards (*) directly in the whitelisted IPs list.
For example, to automatically add all IPs between 111.168.0.0 and 111.168.0.255 to the whitelist, write:
111.168.0.*
To whitelist all IPs between 111.168.0.0 and 111.168.255.255., add:
111.168.*.*
If you want to remove an IP address from the whitelist, simply click on the bin in the same line.
For very limited access, you can then set the Allow access to whitelisted IPs only option to YES, so that only the IP addresses you have defined are authorized to log in.
In the case where your own IP address is blacklisted, you can use your secret key at any time to go back to your Magento 2 admin.
Add IPs to the blacklist
To stop IP addresses from logging into your Magento 2 admin, you only need to add them to your blacklist.
For that, go to:
StoresSettingsConfigurationWyomindWatchlog Pro
In the White/Blacklist settings tab, look for the Blacklisted IPs option. To add an IP address to the blacklist, click on Add. Then in the IP field, enter the IP address you want to block.
You can also set a date after which the IP address won't be blacklisted anymore. Leave that field empty to indefinitely block the IP.
Finally, to remove an IP address from the blacklist, simply click on the bin in the same line.
I recommend this extension for every Magento site owner, Watchlog is a must have extension. I am using it for a few years now and it gives peace of mind about my sites security. Watchlog gives perfect information about login-attempts including IP address (with a direct link to an abuse database) and url where the attempt was made. The extension blocks every brute force attack after a few tries and with the Ip address info it gives it makes it easy to block access to my server via my firewall.
This is a must have extension for Magento. Not only does it give you a real time view of any brute force hack attempts but also cuts them off as advertised. I would whole heartedly recommend this extension to any Magento site owner/developer
I use the Wyomind Watchlog Pro extension because there is no other module like it. It has alerted us several times to multiple attempted unauthorized login attempts.I highly recommend this extension. Wyomind has a support staff as well.
Brute force attacks are daily news nowadays and, besides not always needing worrying (if set up is safe) for every attempt, having a dog barking in the garden is useful, so that you might know if there actually is something going wrong or not. And with the increasing number of Magento installations, you risk entering the attackers attention With WatchLogPro you can anyway easily block any attempt, even if coming from different IPs, and make attackers look somewhere else. It is also good to keep track of who accessed your backend, from where, and when... The name says it all: it's a WatchDog+Logger..
We have had major attacks over the past months and even though the free version lets you know this, we couldn't risk ignoring this and upgraded to the pro. It's a fantastic tool and would recommend it to anyone. It uses a simple UI so no confusion to blocking I'P's on the fly. Keep up the good work.
Only today I received nearly twenty email from Watchlog that an IP had been blocked after 10 attempts. It offers peace of mind knowing that someone is watching the back door and keeping the site secure. I can only imagine how bad it would be without this extension.