Magento 1 Watchlog - Security enhancement for your Magento 2 website
Possible large scale brute force attack on Magento!
Thousands of Magento websites are certainly concerned by this very large brute force attack which aim is clearly to force access to Magento back offices.
The principle of that kind of attack is simple: robots try to log into your back office using multiple login/password combinations until they find the correct credentials.
Once these credentials are identified, your Magento website becomes easy prey for hacking: exploitation of your database, diversion of your payments, hacking, unfair competition...
What to do?
The admin but also the downloader of Magento are concerned with these brute force attacks. You need to make sure to protect each entrance to your back office by adding for example htaccess to the downloader.
Check if your website is subject to these attacks
You can install our free Watchlog extension to detect the intrusions into your back office, you will then be able to track login attempts.
Bypass the attacks
Several solutions exist to make your back office invisible to robots that try to log in:
- Modify the name of your back office
- Activate captcha for your back office
- Restrict the access to your back office by IP with htaccess
You can also use Watchlog PRO that will act as a firewall and so replace all the above steps.
Watchlog Free Vs Watchlog Pro
While the free extension Watchlog lists the IPs that try to access your Magento back office, Watchlog PRO will also help you to stop these intrusion attempts. Watchlog PRO is a more complete version that offers more options than Watchlog.
|
Watchlog |
Watchlog Pro |
|
|
Connection attempts charts Check the daily and monthly login attempts charts. |
||
|
Connection attempts tables Get detailed and summarized tables of the login attempts data. |
||
|
Connection attempts history Define the history lifetime and receive periodical reports. |
||
|
Blacklist and Whitelist Create a whitelist and a blacklist of IPs, allow access to whitelisted IPs only. |
||
|
Automatically or Manually block IPs Block IPs after X login attempts, block the blacklisted IPs for X minutes. |
How to use the Watchlog extension for Magento
STEP 1: Install Watchlog
To install the
- Log in to your Wyomind account.
- From the Watchlog extension page, click on Download and then on BUY NOW (no worry, the extension is free).
- You should be redirected to:
Your accounTLicenses & Downloads - Click the settings icon next to the Watchlog extension.
- Select the version you want to download and click the Download button.
- Install the extension.
- Activate your free license.
STEP 2: Configure your Watchlog extension
You can start with configuring your extension in a general way in:
SystemConfigurationWyomind
In the Connexion attempts
History lifetime in days
Send a periodical report
- Period to report in
days Define how many days you want to include in your report - Report
title Define a title for your report. - Report
recipients Add the email addresses of the recipients separated by a comma. - Report
schedule Define a schedule to automatically send the reports.
STEP 3: Check the login attempts to your Magento back office
You'll have a global overview of the login attempts executed from your admin panel login page if you go to:
System
Statistics on the login attempts will be displayed in graphs and tables.
Login attempts charts
On both graphs, you'll have several curves:
Success : which represents the login attempts that succeededFailed : which represents the login attempts that failed
Login attempts grids
You should find the summary of the last days within two different views:
- Detailed view
- Summarized view
In the Detailed
- The IP that tried to log into the back office
. - The date when the IP tried to log in.
- The login used.
- The message displayed when trying to log in.
- The
URL from which the IP tried to log in. - The status of the IP: Success or Failed.
By clicking on Switch to the summarizeD VIEW
- The IPs that tried to log in.
- The date of the last attempt.
- The number of login attempts.
- The number of failed login attempts.
- The number of login attempts that succeeded.
By default, both tables display data for the last 30 days. You can edit that in the History lifetime in
SystemConfig Wyomind
At any time you can switch between both views.
Magento 2 merchants must adopt certain best practices to protect the site. While we can focus on keeping the Magento 2 version up-to-date and install security patches on time. Other things are server security, file and folder permissions, etc. We did most of it and felt good. We also modified the admin URL as per some other suggested practices but for reason this can be found by the attackers. You can find some articles on this on web. Finally, we had used the Wyomid Watchlog extension - the Free version. The free version allowed us to see if anyone was trying to brute force the admin page to get access to the admin panel of Magento 2. When we did, we found at least 5 IPs in a duration of about 2 months trying to brute force the panel. We also had 2FA and Google Recaptcha enabled so the attempts were not successful. The plugins recorded the IP, attempts and show those on graph. Very nice. We had some more server and security tools to finally block those IPs outside the module (Free version does not offer that). Even when we changed the admin URL after each attempt, some other IP discovered the URL eventually. Even the Free tool is very useful and we absolutely recommend it since you can change the URL in timely manner and buy some time to implement IP rules on server side which will prevent the site performance degradation for legitimate traffic. But if you don't have other resources at the disposal, I recommend to go for Pro version to perform the URL Blacklisting and Whitelisting from admin panel itself. Again, Wyomind security is a must have extension.
We have spent this tool for a long time and it has saved us from many attacks on our website, since it alerts us instantly by email and you can act instantly ... It allows us to be alert 24 hours a day without effort. Extension needed for all magentos ...