Skip to content

Personal support from Ostend   support@kyzoe.be   +32 59 53 00 00

Knowledge base   Blog   Server status   Client areaNLENFR

Over a thousand attack attempts, zero damage: how we protect your website

A look behind the scenes of our security.

Over the past few weeks our servers recorded a clear rise in automated attack attempts on the websites we host. We investigated the situation thoroughly, and the conclusion is reassuring: every attempt was repelled, no damage was done anywhere and not a single website was compromised. Here is what happened and how your site stayed protected.

What we saw

In total, our security system recorded well over a thousand attack attempts of the “webshell scan” type. In such a scan, an automated bot works its way through hundreds of well-known file names — think shell.php, bypass.php or xleet.php — hoping to find a backdoor that was planted earlier and that it can abuse.

Most of this traffic did not come from individual hackers, but from bots running on large, rented cloud servers. They scan the entire internet non-stop, fully automatically. In short, it is the background noise of the modern web: annoying, but something every website in the world deals with daily.

How we stopped it

Our hosting environment uses several layers of protection that complement each other:

An intrusion detection system monitors incoming traffic and recognises the pattern of a bot probing dozens of suspicious paths in a short time. As soon as that pattern appears, the source address is blocked automatically and immediately — often before the scan has even finished. On top of that, a web application firewall filters out malicious requests before they ever reach your website.

The result: every attack attempt simply got a “not found” response, and the addresses responsible were locked out. Each time, the attackers ran into a closed door.

The check afterwards

Because “stopping an attack” and “knowing for sure that nothing went wrong” are two different things, we carried out a thorough verification afterwards. We checked the servers in two ways:

We searched the servers for any malicious files that were actually present, and we checked the access logs to see whether any of the targeted addresses had ever returned a successful response. Both checks came back clean. The few files that looked like an attack target at first glance always turned out to be legitimate parts of WordPress itself or of well-known, trusted plugins — exactly the names attackers try blindly, but completely harmless.

There was no backdoor anywhere, and not a single scan hit its target.

What this means for you

For you as a customer, nothing actually happened: your website simply stayed online and secure, without you noticing a thing. That is exactly how it should be. Security that works is security you don’t notice.

If you want to help reduce the risk even further, these habits make the biggest difference:

  • Keep WordPress, your themes and plugins up to date.
  • Remove plugins and themes you no longer use.
  • Use strong, unique passwords for your admin area.

These three steps close exactly the door attackers are looking for.

To conclude

We believe it is important to be open about what happens behind the scenes — especially when things go well. This kind of attack traffic is, unfortunately, a fixed part of the internet, but thanks to our layered security and active monitoring it remains a non-event for you.

Do you have questions about the security of your website, or would you like to know more about how we protect your site? Feel free to get in touch — we are happy to help.

Read also

Need help with your website or hosting?

Ask your question, we will help you personally.

Contact us
View the plans
EN