--- title: "Right now: the attacks on a small Danish site · Wi24rd" description: "Do you know what is happening on your domain right now? See live what Cloudflare’s defences caught on wi24rd.com – password hunts, WordPress logins and known vulnerabilities – explained without jargon." url: "https://wi24rd.com/en/right-now/" lang: "en" alternates: da: "https://wi24rd.com/lige-nu/" en: "https://wi24rd.com/en/right-now/" --- Live from wi24rd.com # Do you know what is happening on your domain right now? wi24rd.com is a small site. Still, automated attacks knock on the door around the clock. Here is what Cloudflare’s defences caught – fetched live and explained without jargon. [See the latest the defences caught](https://wi24rd.com/en/right-now/#seneste)[How to protect yourself](https://wi24rd.com/en/right-now/#selv) Last day – caught by the defences 7 days – caught by the defences Share of traffic – requests was caught (30 days) Snoopers – looked for files that do not exist (7 days) Times Cloudflare’s defences stepped in during the last 30 days: – Fetching the figures from Cloudflare … Latest ## The latest the defences caught. Each line is a real request against wi24rd.com, translated into what it tried to do. Not all of it is malicious – a forgotten test script can end up in the maze too. The barrier (Bot Fight Mode) and the ruleset stop the request. The labyrinth does not block, but marks the robot and lays traps for it. **No hoodies** Almost all of it is automation: programs on rented servers trying the same tricks against millions of addresses. They do not check what you run. They just try everything. 1. Fetching … What they looked for ## They are not looking for you. They are looking for your keys. The robots ask for files that, on many small business sites, are left out by accident. wi24rd.com has none of them, so they got nothing – but consider whether your web host could answer yes. Known vulnerabilities ## Attacks on software we do not even use. When a new hole becomes public, it often takes only hours before robots try it everywhere. Cloudflare adds a rule for all customers – including the free plan wi24rd.com uses. Where from ## From rented servers, not basements. ### Countries ### Networks The country is where the server stands – not necessarily where the attacker sits. ### Robots that lie – Cloudflare checks that a bot calling itself Google actually comes from Google’s network. [See the crawlers](https://wi24rd.com/en/machine-room/crawlers/) ### The door to the admin area – The admin area sits behind Cloudflare Access: you have to log in with Cloudflare before the page even exists. [See the door](https://wi24rd.com/en/machine-room/the-door/) How to protect yourself ## Most of this is free. wi24rd.com runs on Cloudflare’s free plan. The defences above are not an expensive product, but a few switches and a little care. 1. ### Put your domain behind Cloudflare Move DNS to Cloudflare and switch on the proxy (the orange cloud). Then all traffic goes through their network, and DDoS protection and the managed rules stand in front of the site from the first minute. [Tip 3, step by step](https://wi24rd.com/en/security-tips/cloudflare-proxy/) 2. ### Switch on the bot protection Under _Security → Settings_: _Bot Fight Mode_ challenges known malicious bots, and _AI Labyrinth_ sets traps for dishonest crawlers. [Tip 4, step by step](https://wi24rd.com/en/security-tips/bot-protection/) 3. ### Lock the admin area Put login pages behind Cloudflare Access (free for small teams), so only people you have approved can even see them. [Tip 5, step by step](https://wi24rd.com/en/security-tips/cloudflare-access/) 4. ### Keep watch from outside Get notified when a new port opens, and when someone issues a certificate for your domain. Both are described step by step in [Security tips](https://wi24rd.com/en/security-tips/). [Go to Security tips](https://wi24rd.com/en/security-tips/)[All the figures in The defences](https://wi24rd.com/en/machine-room/defences/) The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. None of the recommendations here are paid, and Wi24rd has no financial interest in Cloudflare. The figures are the same as The defences and The crawlers in the machine room show, and they store nothing about you. [Back to Home](https://wi24rd.com/en/)[To the top](https://wi24rd.com/en/right-now/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/)[The site’s own defences](https://wi24rd.com/en/security/)