Watchlog Pro

Watchlog PRO - Security enhancement for your Magento 2 website

The Watchlog Pro extension will allow you to list the IP addresses that try to access your Magento 2 back office, and to stop these intrusion attempts mainly by adding these IP addresses to a blacklist.

Possible brute force attack on Magento

Thousands of Magento websites are certainly concerned by this very large brute force attack which aim is clearly to force access to Magento back offices.

The principle of that kind of attack is simple: robots try to log into your back office using multiple login/password combinations until they find the correct credentials.

Once these credentials are identified, your Magento website becomes easy prey for hacking: exploitation of your database, diversion of your payments, hacking, unfair competition...

Several users have already reported some IPs.

What to do?

The login attempts can occur several times a minute and can reach several tens of thousands of attempts every day which will deeply threaten the security of your website as you can see on the screen below.

This is why it is important to protect your Magento 2 website against brute force attacks.

Check if your Magento 2 website is hacked

You can first install our free Watchlog extension for Magento 2 to detect the intrusions into your Magento 2 back office in order to track any login attempt.

You'll then be able to see all the login attempts made from your website on 2 graphs.

The detail of each login attempt will be displayed below these 2 graphs. You'll find the IP addresses, dates, logins, and passwords...

How to use Watchlog Pro for Magento 2?

The Watchlog Pro extension allows you to detect if your Magento 2 website is threatened by any possible brute force attack and it gives you the ability to protect your website against it. You can start using the extension very quickly following 3 simple steps.

STEP 1: Configure Watchlog Pro in a general way

To start configuring Watchlog Pro for Magento 2, go to:
Stores › Settings › Configuration › Wyomind › Watchlog Pro

General Settings

In the General Settings tab, you'll be able to configure the lifetime of the history and activate the logs.

• History lifetime in days
  Define a history lifetime in days. For example, you'll be able to define the history lifetime as 30 days in order to automatically purge the history of all the login attempts that are older than 30 days. 
• Enable Log
  By activating that option, a log file will be generated in var/log.

Periodical Report

In the Periodical Report tab, you'll be able to configure the login reports:

• Send a periodical report
  You can choose to receive periodical reports. If you enable the periodical reports, you'll have to configure the following options.
• Period to report in days
  Define how many days you want to include in your report.
• Sender Email
  Add the email address of the sender.
• Sender Name
  Add the name of the sender.
• Send the reports to
  Add the email addresses of the recipients separated by a comma.
• Report title
  Define a title for your report.
• Report schedule
  Define a schedule to automatically send the reports.

You'll then receive a periodical report as below.

White/Blacklist settings

Watchlog Pro gives you the possibility to create a whitelist as well as a blacklist of IPs. In the White/Blacklist settings tab, you can define your own parameters by filling in a certain number of fields:

• Whitelisted IPs
  Click on Add IP to add an IP address to the whitelist.
  You also have the possibility to add a Note that will be displayed in the login attempts grid.
  

  

• Secret key to whitelist your IP
  If your own IP is blacklisted, you can use that secret key to whitelist it.
  See how to add your IP to the whitelist.
• Allow access to whitelisted IPs only
  Choose to allow access to whitelisted IPs only.
• Blacklisted IPs
  Click on Add IP to add an IP address to the blacklist.
  You can define an end date and hour for blocking the IP address.
  You also have the possibility to add a Note that will be displayed in the login attempts grid.
• Number of attempts before being blacklisted
  Define a number of attempts before the IP is automatically blacklisted.
• Blacklisted IPs blocked for X minutes
  Choose to blacklist the IPs for a defined period of time.
• Message to display if blocked
  Define a message that will be displayed if someone with a blacklisted IP tries to log in to your admin panel.

Blocked IP Report

You'll be able to receive a report every time an IP address is blocked. For this, you can configure the report in the Blocked IP Report tab:

• Send a report when an IP is automatically blocked
  Choose to receive a report when IPs are automatically blocked or not. By setting that parameter on YES, more options should display.
• Sender Email
  Fill in the email of the sender.
• Sender Name
  Add the name of the sender.
• Send the reports to
  Enter the email addresses of the recipients separated by a comma.
• Report title
  Define the name of your report.

STEP 2: Check the login attempts to your Magento 2 admin

To have an overview of the connection attempts to your Magento 2 back office, go to:
Stores › Watchlog › Connection attempts

Login attempts charts

On that page, you'll get 2 graphs that retrieve the login attempts statistics.

These graphs are based on 2 different periods of time in order to provide you with maximum information. The first chart will display the statistics in the last 30 days whereas the second one will sum up the login attempts in the last 24 hours.

Both graphs show 3 different curves:

• Success: login attempts that succeeded
• Blocked: login attempts that have been blocked
• Failed: login attempts that failed

If you hover the mouse over the different points of the curves, you'll get the detail of the number of connection attempts at a specific date.

Login attempts detailed grid

Below the 2 graphs, you should find the summary of the login attempts over the last days retrieved in a grid. The login attempts data are retrieved into specific columns:

• IP
  The IP that tried to log into your Magento 2 back office.
• Date
  The date when the IP tried to log in.
• Login
  The login used.
• Password
  The password used to log in.
• Message
  The message displayed when trying to log in.
• Url
  The URL from which the IP tried to log in.
• Status
  The status of the IP (Success, Failed, or Blocked).

By clicking on any IP address, you'll be redirected to www.abuseipdb.com which will automatically check that address. This allows you to see in one click if the IP address has already been reported by other users. 

You have the possibility to purge history by clicking on Purge history now and to send the report of the login attempts by clicking on Send the periodical report now.

Login attempts summarized grid

You can get a summarized view by clicking on Switch to the summarized view. From that new grid, you will get a table with the basic information:

• IP
  The IPs that tried to log in
• Last Attempts
  The date of the last attempt
• Attempts
  The number of login attempts
• Failed
  The number of failed login attempts
• Succeeded
  The number of login attempts that succeeded
• Blocked
  The number of login attempts that have been blocked (these IP addresses won't have access to the Magento 2 admin login page)
• Action
  You can directly add these IP addresses to the white and blacklists

To remove an IP address from a list, simply click on Remove IP from the white/blacklist.

You will be able to see if you have already blacklisted or whitelisted some IP addresses. Indeed, they will be displayed in black or white boxes. In the case where an IP is whitelisted and blacklisted at the same time, the whitelist will always have the upper hand.

By default, both tables display data for the last 30 days. This can be easily modified in the History lifetime in days field, from :
Stores › System › Config › Wyomind › Watchlog

Note that to go back to the detailed view, you just have to click on Switch to the detailed view.

STEP 3: Manage traffic to your Magento 2 back office

With Watchlog Pro, you can easily control and manage the traffic to your Magento 2 admin. You have 2 possibilities for doing it:

• Whitelist IPs
• Blacklist IPs

Add IPs to the whitelist

You can add as many IP addresses as you want to the whitelist. For this, go to:
Stores › Settings › Configuration › Wyomind › Watchlog Pro

In the White/Blacklist settings tab, look for the Whitelisted IPs option. To add an IP address to the whitelist, click on Add. Then in the IP field, simply enter the IP address you want to whitelist.

Note that you can use wildcards (*) directly in the whitelisted IPs list.

For example, to automatically add all IPs between 111.168.0.0 and 111.168.0.255 to the whitelist, write:

111.168.0.*

To whitelist all IPs between 111.168.0.0 and 111.168.255.255., add:

111.168.*.*

If you want to remove an IP address from the whitelist, simply click on the bin in the same line.

For very limited access, you can then set the Allow access to whitelisted IPs only option to YES, so that only the IP addresses you have defined are authorized to log in.

In the case where your own IP address is blacklisted, you can use your secret key at any time to go back to your Magento 2 admin.

Add IPs to the blacklist

To stop IP addresses from logging into your Magento 2 admin, you only need to add them to your blacklist.

For that, go to:
Stores › Settings › Configuration › Wyomind › Watchlog Pro

In the White/Blacklist settings tab, look for the Blacklisted IPs option. To add an IP address to the blacklist, click on Add. Then in the IP field, enter the IP address you want to block.

You can also set a date after which the IP address won't be blacklisted anymore. Leave that field empty to indefinitely block the IP.

Finally, to remove an IP address from the blacklist, simply click on the bin in the same line.