How to reduce website vulnerability scansIf you run Microsoft IIS or Apache HTTP Server on Windows, you may notice repeated requests for pages and files that have nothing to do with your website. PHP scripts on an ASP.NET site, WordPress login pages on a site that does not use WordPress, or attempts to read Linux system files from a Windows server are familiar examples. Many of these requests appear as 404 (Not Found) errors in your access logs. Automated scanners try large numbers of URLs in search of vulnerable applications, exposed credentials and forgotten backups. Your website does not have to use the software they are looking for: the same probes can be sent to many different servers. The following excerpts show selected fields from web server logs. The first example contains repeated requests for files that may hold AWS credentials: The next example shows directory traversal probes in the query string. The scanner tries different paths to reach Even unsuccessful probes consume processor time, memory, bandwidth and log space. A patched server may reject every request, yet still spend resources handling repeated scans from the same addresses. RdpGuard helps reduce this repeated traffic. It monitors IIS or Apache access logs, identifies requests matching your detection rules and temporarily blocks the source IP address when detections reach your configured limit. This stops that source from continuing to probe your server during the blocking period. The standard rules detect requests for common credential and repository paths, and group repeated HTTP 404 responses into detections. Additional rules can target other paths or query strings relevant to your website. For example, the traversal requests above need a matching Query rule, unless their responses already trigger another rule. A suspicious request shown in a log is not automatically covered by every rule set. Keep your web server, CMS and plugins up to date, and keep credentials and private backups out of publicly accessible folders. Blocking repeat scanners complements these measures; it does not fix an exposed file or a vulnerable application. For 64-bit Windows and Windows Server. Supported Windows versions. See alsoHow to enable and configure HTTP protection for IIS and Apache - select log folders, adjust detection rules and configure blocking thresholds. Behind a reverse proxy, identifying the original client and blocking its requests require additional setup. See the proxy and X-Forwarded-For settings. | RdpGuard 10.4.5 Free Trial RdpGuard protects:
Our customers say "This sotware is really great. It's a relief. Because my server is constantly under attack. Thanks RdpGuard" - Joaquim De Sousa Marques "Nice product. I used to implement something similiar in a low-tech and cumbersome manner via a script called TSBlock (not mine). This makes it much easier and is well worth the pricetag for SMB's." - J. Johnson "Absolutely amazed at your product. We are a church in the North Dallas area, and I discovered this morning multiple failed logon attempts via our Remote Access Server. A friend suggested your product, so I immediately downloaded the trial. It had a list of about five blocked IP addresses in minutes, and that was enough to lead me to push the BUY button. Over the past 10-15 minutes the list is now about thirty with at least a third being international attempts to break into our system. Thanks for a great product. You may have just saved us much grief." - John Hallford "Love the software. RDP on our Windows servers is just ridiculous. We would block it in the router but we have lots of old-time customers that would have issues." - Scott Hirsch "Love the software! Makes it easier than tailoring VB Scripts!!" - Nick Brennan "It's a great product - really stopping those RDP attackers :-)" - Dave, UK "First of all: Your application is very (!!!) useful and I like it very much securing my 2012 R2 server. RdpGuard is the best solution, I found on the market and after 10 minutes of testing it I ordered the fully-featured version. :-)" - Carsten Baltes Our Other Products |