Moeez: I’m assuming a lot of you over here are site owners. A lot of you over here are people who run websites for themselves or their clients or their agencies or for their friends, and you must deal with bot traffic on a daily basis, right? It’s usual for site owners to deal with bot traffic and it’s important for us to learn how we can manage bot traffic on our website, how we can detect good bots versus bad bots. Which is why we have an amazing set of panelists over here today among us who will be taking us through this topic, and I’m sure you’re going to be getting a lot of information on bot traffic and how to manage those bots.

So let me first introduce our guest speakers for today. So first up we have Akshat Choudhary. Akshat, thank you so much for being here. I know this is not the first event that we are doing together. We have been hosting and doing events for the past couple of years, and I thank you so much again for being here and talking about security and just enlightening our audience with your knowledge.

Akshat Choudhary: Hi Mohammad. It’s always good to be part of the Cloudways Security Bootcamp. It’s such a great event and thank you again for having me. And yeah, I’m glad to be here to talk about bots which is such an important topic.

Moeez: Perfect. Thank you. So anyone who doesn’t know who Akshat is, Akshat is the CEO and founder of BlogVault, which is a leading WordPress backup and security solution. He’s also the driving force behind MalCare and the WP Remote platform, focused on website security and management. He has over a decade of experience in the WordPress ecosystem and has been playing a crucial role in making sure that WordPress websites all over the world are safe and secure.

With that I would like to invite my second guest on stage, Greg Fisher from Limit Login Attempts. Greg, so happy to have you over here. For people who don’t know who Greg is, Greg is the CMO of Limit Login Attempts, a leading WordPress security plugin with over 2.5 million active installations, and he has over 20 plus years of experience in digital marketing and he co-founded multiple ventures as well. So Greg, thank you so much for being here. I’m excited to have you on this panel.

Greg Fisher: Yeah, appreciate being here. Thank you.

Moeez: Finally we have Guriy Habarov. Guriy, thank you so much for being here. Guriy is the CTO of Limit Login Attempts, from the same team, bringing over 20 plus years of experience of development and management. I am super excited to have all three of you over here on this session and I can’t wait to start off with the questions for this panel. Again I just want to remind everyone over here who are listening to this broadcast that we do have a prize for the most engaging attendee of this event. So make sure that you keep asking questions, leaving comments in the chat to make sure that you have a chance to win prizes.

So let’s start off, fellows, with the first question of the day. My first question is for Greg. Greg, your latest brute force attack report uncovers some alarming trends, right? Can you share the most shocking insights and what they mean for website security in 2025?

Greg Fisher: Yes, thank you. We did a brute force attack report for 2024. You can go to our website, go to our Force Attack Trends blogs and view the entire report. But a couple of the most interesting things we saw from this is that brute force attacks have increased year-over-year per average domain. We have approximately 60,000 domains in our premium network that we actually receive IP data from, and it increased by approximately 120% year-over-year. So brute force attacks are becoming much more prevalent in WordPress sites more than ever.

Also another thing that was interesting is that IP addresses that originate these brute force attacks, China and Singapore had the most steady incline of attacks compared to other countries. So surprisingly we’re seeing emerging markets having more IP now. Brute force attacks can originate from multiple different countries, some of them are run by proxy, but we also saw a decline in IP addresses from the US. And we have assumptions to why that might be, but we saw that kind of interesting that less brute force attacks are originating from US domains. So those are like the two main things from the report that we kind of took away.

Moeez: Awesome. Next question is from Guriy. Guriy, as bot attacks become more advanced, what are the biggest mistakes people still make when trying to detect bots and block them?

Guriy Habarov: Yeah, the bot attacks become more advanced. So the main idea is to stay ahead of them, right? From that perspective, the biggest mistakes are, well, the first is relying on static methods, for example maintaining a static list of bad IPs, especially when done manually. Same goes with having a static list of browser signatures and user agents. That’s because modern bots are very dynamic, as you know they can easily change IPs, especially with IPv6 coming into play, and they can easily mimic user browsers and their fingerprints as well. So you have to find a dynamic solution for the site defense to stay ahead.

The next common mistake is using a security tool alone, isolated from other tools. For example if you use just a captcha or just a list of bad IPs or just 2FA or rate limiting alone, those measures are usually insufficient on their own. You should always use a layered security approach because the modern bots exploit different layers of security, not just one.

And another mistake that I would mention is a lack of understanding of how a regular WordPress website and the server works and how it is visible to a bot. So for instance a bot can attack a site that was just launched and is not even listed in search engines, and that is usually a big surprise for a user. Also if you just updated your username for example, a bot can get the new one immediately and continue brute forcing it. That’s because by default, you probably know that WordPress has usernames publicly exposed via its API and bots like to use it a lot.

Also the fact that the user installed a security plugin itself doesn’t usually mean that the attacks will stop. That is a very common delusion and we have a whole article about that. So to stop the attacks completely you need to set up a proxy, and that proxy should be smart enough to recognize the WordPress attack specifically and to not harm user experience at the same time. And this is usually something you cannot implement easily. For instance we have thousands of clients who use Cloudflare and still they need the extra protection from us.

Greg Fisher: Yeah, one thing I just wanted to mention is that we get dozens of customers somewhat daily that just cannot believe that they’re getting this many attacks and they just launched their website like a day ago and they’re like, how can they do it? And the reality is that the brute force bot detection can happen from a hosting server level. So they already kind of zeroed in on that host. They already know how to find that website immediately. And that’s a big misconception, we have to constantly explain this to users, that just because you just launched a site today doesn’t necessarily mean that you can’t be found immediately.

And that’s something hard to explain to a new WordPress user. They just don’t believe it. They honestly think that we’re doing it. It’s like, hey, are you creating these attacks just to get us to upgrade to premium? No. These are legitimate brute force attacks that happen on day one. So that’s why when you launch a website, especially if you’re a hosting company, you need to have protection immediately. You can’t wait months to start putting security plugins and start taking action. You got to start on literally the day it launches.

Moeez: Yeah, makes sense. Akshat, do you have anything to add over this, the biggest mistakes website owners make when trying to detect a bot and block them?

Akshat Choudhary: I think what these guys have covered is quite comprehensive. We see so many common mistakes and there’s so much bad advice out there, especially for WordPress website owners, things like hide WordPress, hide WordPress login page, hide XML-RPC. There are a lot of common mistakes people make and unfortunately what they don’t realize is, the way WordPress works, the sites can still get overloaded. Does the password get cracked? What is exactly happening? The visibility is not there. So people make a lot of such mistakes and the answers are much more complicated.

So there are lots of mistakes and a lot of it is actually, I believe that a lot of the mistakes is because of really bad advice out there, because if you see so many people writing so many articles, they are filled with so much bad advice and it’s so difficult to distinguish good from bad because all of them come with great authority. So you will come across so many articles which say the first thing you should do is change your login URL, change your login page. Now is that a good thing? Is that a bad thing? For a layperson it’s really difficult to understand, will that protect you from a bot attack, will it not? In theory it should. Okay, but then what are the downsides?

So there’s that critical analysis, really difficult for a layperson to do. And that’s what makes security such a tricky and such a difficult topic to discuss.

Moeez: Yeah, completely agree, and I think you rightly mentioned that a lot of good or bad advice comes from very good authority. So it’s very difficult to distinguish and decide which ones to follow and which ones not to. Akshat, I will continue asking you another question, which is, with the advent of AI and technology, how can people distinguish between real bad bots and real users, right? Because it’s sometimes very hard to distinguish because the user behavior is almost very human-like, but it’s not a human. So how do you suggest people distinguish between real users and bots?

Akshat Choudhary: No, it’s not an easy thing frankly, and we are still in the early stages of the AI curve frankly. Like we are still very very early and we are already seeing AI bots resemble humans more and more. Okay. So a lot of bots that we are blocking actually are the non-AI bots. The AI bots that we see, they behave so much like a normal human. They are filling forms. They are doing brute force attacks. They’re doing credit card testing. And traditional methods that we used to protect from them just do not work anymore.

Earlier you could throw a captcha at them. I’m seeing captcha getting solved. You know, Google V2, V3, that’s getting solved. We are seeing, earlier a lot of firewalls had a very simple JavaScript based check, they would test for browser, but these bots are now solving them. And we are seeing this in action again and again, like our firewall, our data is clearly showing that bots are circumventing these things. So tracking these bots is non-trivial.

I think what’s going to happen is you will need to do a lot more behavioral analysis. I think rate limiting, like what Limit Login does, or rate limiting, will play a role, but also global networks and solutions like Cloudflare or proxies will play an even more important role, because as they have more data, they can, or people who have more data can help protect you in a better manner. So I think the data will be the answer to this.

Moeez: Perfect. Very insightful, Akshat. Now my question is for all three of you. For someone managing a WordPress site without deep security knowledge, what are three immediate actions that they should take today to stop bot-driven brute force attacks? Greg, I would go with you first.

Greg Fisher: Well obviously you got to install Limit Login Attempts Reloaded. That’s the first thing. Definitely limiting excessive login attempts is the easiest thing you can do, the first thing you should do to prevent brute force. Obviously having a good password policy. So let me give you an example of why a lot of times password fails. So you take a small business and they have the owner who knows good password policies, they have a strong password, they don’t reuse passwords like you shouldn’t. But it’s the employees that are typically the culprits.

So the employees get a login, maybe they get a manager login for WordPress that they can allow to post blogs, and they use poor password policies. They reuse passwords from previous websites and they’re the ones that are causing the issue. They’re the ones getting hacked, and that’s why it’s important to have company-wide policies when it comes to protecting your sites. So I would say, aside from getting security protection, a security plugin, just having good sitewide company policies for password protection.

Moeez: Perfect. Guriy, any insights on this one?

Guriy Habarov: Yeah, I would add that updating your passwords so they are strong and unique. And I want to emphasize the word unique because one of the very common types of attacks is credential stuffing. And so the best way to avoid it is to use a unique password on every website you use. And I would also add creating a backup, because if you get hacked, at least you will not lose your data and can restore your site afterwards in a new clean environment.

Moeez: Interesting. Akshat, anything to add over here?

Akshat Choudhary: Yeah, so I think both, obviously limiting login attempts, all of that is very essential, and having strong passwords. So sometimes enforcing and having strong passwords is important. Doing two-factor authentication is also very useful because it can help you from things like phishing in many cases. We have seen that having a really good firewall which can protect you, which has good IP scoring or IP rating, that can also help you. So yeah, these are good methodologies to protect your site.

Moeez: Amazing. Again I would start off with Guriy on this one. What’s the most effective way to monitor login attempts and detect suspicious activity before it turns into a full-blown breach?

Guriy Habarov: Yeah. Well, first of all you should use a well-known trusted security plugin. For example Limit Login Attempts Reloaded, it can reduce the velocity of attacks by ways of throttling and dynamic IP denial. The second one would be set up real-time alerts. And also I’d recommend you to make a habit to analyze logs. So some plugins provide login logs, and you can also check your server logs from time to time, and I would recommend putting this on your calendar and doing it on a regular basis.

Moeez: Awesome. Greg, anything to add over here?

Greg Fisher: Yes. So just recently we launched a new feature where you can actually review your login logs, your successful login logs. And why that’s important is because, back to the employee issue, is that let’s say that someone does break in and logs in legitimately. So you need to know who’s coming in and coming out of your website. If you identify someone from another country logs in, then most ideally this is not one of your team members and you can take corrective action.

And so it is very important, like Guriy said, to make sure that you are monitoring not just your brute force activity but the successful login logs to ensure that, and even besides brute force activity, maybe it’s an old employee that still has access that’s going in there and maybe has malicious intent. So there’s sometimes some human components to security that we often forget. So I just wanted to mention that.

Moeez: Perfect. Akshat, anything to add to this?

Akshat Choudhary: Yeah, so I have a slightly different take. I think it’s just the nature of the internet that every public endpoint will be attacked. Okay. If you have a public endpoint you’re going to get attacked. Now if you’re a normal person running a website, but running the website is not your core business, your core business is to do your business, whatever that core business, you might be running a store or you might be running a salon or whatever, and that’s what you want to focus on. What you want to do is rely on a good security plugin, or something like Limit Login or MalCare, which just takes care of it, because it’s just the nature of the internet.

You cannot, it’s not possible for a normal person to sit and review logs. It’s super difficult. There are lots of activities happening. Make sure that the plugin is doing its job. Make sure that you have a strong password and having some basic stance using a good security plugin, and then monitoring. Have monitoring, have systems in place. Like if you have MalCare you will have an activity log built into it. But you should not be getting alarms for attacks happening. Let the security plugin do its job. Otherwise you are going to lose your mind altogether.

Greg Fisher: I agree with you on that. But if you are not watching the velocity of brute force attacks it could affect performance. And I could tell you a number of examples where our customers had elevated amounts of brute force attacks that have slowed down and affected performance during heavy shopping seasons that we had to come in and help provide other solutions for them. So I agree on a day-to-day basis it doesn’t make sense to review your logs, but if you’re getting an elevated attack it should be something that you need to be aware of.

Akshat Choudhary: Yeah. Absolutely. There are critical situations, but those are critical edge cases. But it’s super easy for people, because again, I think like Greg is mentioning, it’s the edge case when you need to know it, like when you have a real attack. But it’s super easy to have minor attacks where the firewall is taking care of it pretty well and you can still get alarmed by it because you just don’t understand, hey is this a big attack or is it not. And that nuance has to be captured well, because in the absence of it, people start blaming, or people start really double guessing, are they even capable of running the site or managing the site, or they start blaming their web host. So there are so many of those factors, and we have seen this so often, right? So trying to be more practical is the approach we like to take.

Moeez: Yeah. So a little differences of opinion over there, but I think that’s the beauty of having a panel discussion, so we get to see and hear more of what other people think about a certain case. So before I move on to the next question I would like to take a question from the audience over here. So you mentioned, Akshat, about Google captcha being solved by bots and AI. So Resty over here asked, what is a good Google reCAPTCHA alternative for forms and checkout, because it’s obviously not effective anymore?

Akshat Choudhary: So it’s not, I wouldn’t say it’s not effective, but we are seeing, like I saw V3 reCAPTCHA again getting solved multiple times. It was actually strange how well the bots were able to handle it. But I think this is a game of cat and mouse. So what we will see is there are certain places where bots will invest a lot more. There are other places where captchas will be complex enough that bots will not invest because there’s a cost involved in doing so. So it just comes down to what is it that you’re trying to protect and then the level of protection that you add there. So I think Cloudflare has a captcha which is pretty good, but again, I think Greg mentioned it, or Guriy mentioned it, that it’s a layered approach, right? So it’s not by itself. It can help, but if you have multiple layers, one of the layers will catch it for sure.

Moeez: All right. Greg, Guriy, anything to add over here?

Greg Fisher: You know, we have a lot of our customers that ask us why we don’t have captcha as a form of protection, because it doesn’t work anymore. So for the most part, we don’t believe it’s an effective security solution because the bots are getting smarter and they’ll just break it. Really 2FA and then limit login is more in line of ample protection nowadays. So as far as alternative, I know Limit Login Attempts in our premium version, we do protect forms as well, and maybe Guriy can talk a little bit more about that, but I’m not really familiar with any other particular solutions that protect forms. But Guriy, if you have anything to add on that.

Guriy Habarov: Yeah, we are planning to implement this feature. It will be based on our huge data set, and basically it will be similar to what we are already doing with our login pages, but we will apply this to other forms of the website like comment forms, checkout forms and other different forms. But yeah, in general I agree with Greg. Nothing to add here.

Moeez: Perfect. So moving on to the next question, and I would start off with Greg on this one. Greg, based on the latest brute force report, the one that you worked on, can you walk us through an example of a real world attack scenario and how a website successfully mitigated it?

Greg Fisher: Yeah. So a typical real world scenario, brute force attacks typically are not constant. You could go a couple weeks with very little activity and then a couple days you could get massive spikes, and then if the brute force bot doesn’t achieve success it just kind of moves on to the next one. So that’s typically what we see in most cases. So a real world example is that they have a massive spike. There might be some performance degradation because they’re just getting bombarded.

And so what our plugin does, our premium version, it absorbs that traffic, so your website can retain its performance. And then we use our cloud intel. So we have tens of thousands of domains that we pull IP data from on a daily basis. So we’re using that IP intelligence to counter all of these attacks and absorb them, so your site can remain at its optimal performance. So that’s a typical example of what we see when it comes to brute force and how the attacks happen.

Moeez: Awesome. So another question that I have over here in the panel discussion questions, and I think one of the people in the audience also had this question, I’m just going to move on to that one. Let’s say a site owner suspects that they’re under attack. They just had this signal or they felt that there is something wrong with the website and it might have been compromised. What’s a step-by-step emergency plan that they should follow? What is the first thing that they should do and what is the most important thing that they should do? Akshat, can you take us through that?

Akshat Choudhary: Okay, so there are two parts to this, right? One is a site is under attack, as in they’re under attack by a bot, and the second part is the bot has gotten through, or there is a bot. In fact bots are not always brute force bots. There are also bots which are trying to exploit vulnerabilities, which are also very very common and a very big source of sites getting hacked, which we see very often with MalCare.

So the very first thing you should do, if you suspect your site has gotten hacked, is install something like MalCare, a security plugin, which will deeply scan your site and identify if it has been hacked or not first. That’s the first step because first you need to know if it has been compromised. If you suspect it has been compromised, you should be having a system in place where your site is regularly scanned, like using something like MalCare, to ensure that your site is getting scanned every day, and if there is any hack or any irregular activity, then that is quickly flagged and then you can take a quick remediation. And the quickest remediation to take is to get rid of the hack or remove the malware at the earliest. The longer the malware is around, the more damage it causes.

So removing the malware at the earliest is super important. I think one of the mistakes which people make, if they think that the site is hacked, is they try to restore it from a backup, which we think is a really bad idea, because you don’t know whether your backup has been infected or not. So essentially what you need to do is first try and remove the malware in a very specific manner, by first identifying what happened, where is the malware and removing all the backdoors, and once you are confident about it, then go about securing your site by installing a good firewall. So that’s our approach to protecting your site if you think it’s compromised.

Moeez: Awesome. Anything different that you might suggest, Greg, Guriy, anything you want to add to this? Guriy?

Guriy Habarov: Yeah. Well, I can look at this topic from the person who worked in a hosting company for five to 10 years. And the most frequent issue with the sites being attacked is their reduced performance. So I would suggest the following course of action in this situation. The first thing you should do is you should confirm that the site is indeed under an attack. For that you should check some logs and check your site performance.

The second step would be notifying your dev team if you have any, or your hosting provider if you are not self-hosted. And usually, well, in emergency situations your website can go down, and if it goes down, you should block all IPs other than your developer IPs. This should be done on the server or proxy level. Then you should create a backup of your site. The next step would be unblocking all IP addresses but start blocking them again, and you start blocking the most active attacking IP addresses. Again this should be done on the server or proxy level and unfortunately it should be done manually based on your logs.

Also another measure could be temporarily increasing your computing resources, and if the attack targets some nonspecific pages you can cache them as well. So all of these are the most frequent scenarios that we experienced in the past, and this is the most effective way of getting your website back on track, especially during some busy seasons or during some events. For example when we had a network of newspaper websites, this was a pretty common issue when they publish a hot new article and there’s an increased amount of traffic, even legit traffic. So we had to deal with issues like that, and I think this is usually enough to respond to the attack. The next steps would be planning on how to avoid them in the future.

Moeez: Perfect. Thank you. Greg, anything that you would like to add to this, or is it something that you think your thoughts are similar to Akshat?

Greg Fisher: No, I just echo the other panelists here. So if you’re under attack the first thing you’re going to notice is degraded performance, and then from there on it’s exactly what these guys said. So I don’t really have, yeah. I mean all of our customers from Limit Login Attempts, when they decide to step up their security, it’s always like, hey my site’s slow, it’s not loading the page properly. It always starts there.

Moeez: Perfect. Before I move on to the next question I would just like to again call in the comments section, see what our audience is up to. So Ralph doesn’t have a question but it’s more of a comment. One of my best security practices is to never rely on just one level of login or form security, but to use multiple layers of security and security measures. So I think that’s very practical and I think very common among site owners.

So Anto actually has a very good question, I just wanted to address this one before I move on to the next question. He asks, what industries or types of websites are currently the biggest threat or target for brute force attacks? Is there an industry or a niche that is certainly more exposed as compared to others?

Greg Fisher: Yeah, I can take this one. So typically brute force attacks are very agnostic. They’ll go after small websites to very large ones. It’s all about what are they trying to achieve, and for the small websites, even though there might not be a monetary or ransomware opportunity, they use those sites as proxies to launch other attacks. So just because you’re a small blog doesn’t necessarily mean that you don’t have value to a hacker.

Now we also see a spike in brute force activity around seasonality. So like during the holiday shopping season we see a high increase in brute force attacks because, one, IT departments are on vacation, and two, if they do attack and are successful, they can use ransomware or other forms of crime to give access back to the site owners. One of the things we saw with a couple of our clients where they’ll attack the site, they’ll claim that they have a bug that’s slowing down their site, and then there’s some deal with crypto to restore access. There’s all sorts of things that could happen.

But really, the bigger e-commerce stores are not necessarily the targets in that respect. Sometimes it’s those medium-sized businesses or mid-market businesses that they could actually extract value out of, because they’re not big enough to where they have big IT departments, but they’re big enough to where they can generate some money by ransomware and whatnot. But really brute force attacks are mostly agnostic. They have a purpose in each industry, small or large, of what they’re going to do when they attack, whether it be using it as a proxy or using it to use ransomware.

Moeez: Anything you want to add, Akshat or Guriy, anything you feel differently on this topic?

Akshat Choudhary: No, I think Greg said it pretty well, that it’s pretty agnostic. And yeah, even like I think Greg had mentioned earlier, a site spins up and it’s under attack. So yeah.

Moeez: I’m assuming Guriy you have the same opinion as Akshat.

Guriy Habarov: Yeah, I can echo Greg.

Moeez: Perfect. Yeah. So I’m just going to make sure that we take all the questions from the comments before I move on to the next panel question. And let’s see what people over here are talking about. So NK Toy says that captcha is dead. They think that the new AI bots can solve them better than humans. So thank you so much for this comment.

So I think this is pretty much it from the questions and the comments so far. I’m sure there are going to be many more once we move forward with the session. So I’m going to be moving on to the next question from the panel, and I’m going to talk more about the future of bot mitigation. What does the future hold for website owners, and with AI shaping both attacks and defense mechanisms? I mean you have people using AI for bot attacks and then you have people using AI to defend their websites from those bot attacks as well, right? Where do you see bot mitigation heading in the next two to three years? Where do you see the shift in technology when it comes to website owners or developers coming up with solutions that can completely mitigate bots? Guriy, can you take us off with that one?

Guriy Habarov: Well I think we’ll see more security systems using machine learning under the hood, and we are already heading into that direction with our plugin. I also think that more systems will start integrating with each other to increase the combined efficiency, because, well, based on how we work on our cloud side, I can see a huge potential in sharing information and data between different websites, so then they can fight together against botnets. So it would be like something opposite to a botnet, like a dark side versus light side. So yeah, but the most exciting thing is machine learning right now I think, and I’m happy to find out what is going to be next.

Moeez: Nice. Akshat, anything that you want to add to this? The future of bot mitigation. You obviously are working in this industry for the past decade or so, anything that you see changing over the next decade?

Akshat Choudhary: Yeah, so again, machine learning, AI will be needed to fight AI and machine learning more specifically. I think cloud-based solutions, because of the nature of it, and especially because of this change of scale and the number of IPs that we see increasing, a cloud-based solution, hybrid solutions, will become more prominent and more important than we have seen in the past. So yeah, machine learning, cloud-based solutions, I think we’ll go more in that direction in the next few years.

Greg Fisher: Yeah, I’m just going to echo these guys here. So last year we would counter around 88% of all attacks prior to them hitting their login database, and our attack efficiency has grown from 88% to 97% in a year because of the cloud data that we have. So just like Guriy said, there’s a light side there, there’s good guys that are gathering all this IP intelligence and using it to protect the entire WordPress network. And the more sites that participate in this, the stronger our protection will be as a whole.

And it’s getting more complex where these IP addresses could be legitimate one day but then be bad the next. So that’s what we’re doing at Limit Login Attempts Reloaded. We’re making sure that we build the most powerful cloud-based IP intelligence in WordPress so that we can do the best job we can to protect the entire community. But there’ll be other services, I’m sure, like MalCare, that are going to support that effort. But we really need to work as a group here. It’s kind of like herd immunity with vaccines. We want to make sure that the more of us that are secure and protected and using cloud-based technologies, the better the network will be as a whole.

Moeez: Perfect. Thank you so much gentlemen. There’s another question in the comment that I want to get your attention towards. So Riyad Brie has a question. He wants to thank us for the session. You’re welcome Riyad. He has a question. Can you say something about the backend hacking implication of these issues? I assume we are only talking WordPress. What are the tools used and what can you do in the WordPress backend and dashboard? What can you do especially for example in the HTML level or in Python? If you guys can answer this question that’s fine, if you can’t that’s also completely fine, but I just wanted to make sure that we address this question because I think it’s a good one.

Akshat Choudhary: Yeah, I think that I’m not very familiar with the tools and it’s a completely different, Guriy, are you familiar with this question at all?

Guriy Habarov: Yeah, sorry, I barely heard the question. If you repeat it.

Moeez: I think what the user is trying to ask is, what are some of the tools that attackers use to attack websites, and in the backend, what can we do to protect our websites?

Guriy Habarov: All right, so yeah, we had some events related to that in the past and usually it works like that. Imagine that a hacker knows your password, well their login attempt was successful. It can happen via your login page or via FTP. Their next step is installing a plugin. That plugin will be named somehow legit, so you cannot find out very fast that this plugin is malicious, and that plugin opens basically the whole website for that hacker remotely. They can do whatever they want, and the worst case scenario is that they start silently gathering different information, for example logins, unencrypted passwords, payment information, etc.

And well, from my experience this is the most frequent way of doing this stuff. Of course they run some viruses that infect a lot of files across the whole WordPress installation. But if we are talking about tools, very frequently they just upload some already made plugins, and I think those plugins are taken from someone somewhere online. A lot of people publish them on GitHub. And well, we saw plugins like, the two most frequent were the plugins for newslettering, they just send out spam, and the second one was like a shell. It provides full access to your WordPress installation and you can do whatever you want with it.

Moeez: Awesome. So gentlemen, I’m going to be moving towards the final question of this session, and again it’s something about the future, the future of web security, the future of bot protection. So if each of you had one golden rule that you would like to share with the audience about bot protection in 2025 and beyond, what would that be? I would start off with Akshat on this.

Akshat Choudhary: Okay, so my approach is that yeah, there are lots of bots out there. Instead of trying to protect yourself from all the bots, you understand the bots that you want to protect your site from, the ones that are really dangerous, that are going to use resources or hack your site, and have an approach for that, instead of like, hey, there’s a small bot there that’s accessed my site or that’s scraping my site. Yeah, there are some bots you should just let it be and focus on the bots which are really dangerous or using up the resources. So that’s one approach that we think we need to do more and more of in the future.

Moeez: All right. Guriy, you want to go next?

Guriy Habarov: Yeah, I would say the golden rule would be, always set up multiple layers of security. So your security should look like a sandwich.

Moeez: All right. Greg?

Greg Fisher: I was going to say the exact same thing Guriy said. To have layers, you know, 2FA, limit login, malware scanning. You don’t have to be an expert in security to have a secure website. That’s why you have us up here. We’re building the technology, we’re doing that work for you. And you can secure your website for very little. And I also would caution to not rely too heavily on free plugins for your security, because free plugins obviously are limited in what they can do. And some sites might be fine with free security plugins, but a lot of the premium features are where you’re going to get a lot of the meat in security. So just be cautious of just going for the cheapest option.

And I’m not sure how much MalCare is, but even our premium annual is $40 a year US dollars, and it’s not very much to get much more protection. So just consider how valuable your website is. If your website’s generating millions of dollars in e-commerce and you’re relying on a bunch of free tools to secure your website, it might be a good idea to pay for the premium versions of some of these plugins, whether it be MalCare or Limit Login Attempts, because that little extra could go a really long way in securing your sites.

Moeez: Perfect. I think that with that I would like to conclude this session, and I would like to thank all three of you for being here today out of your busy schedule and answering questions for us. I’m sure all the people listening to this session must have learned a thing or two from you guys on how to protect their websites from bots and how to identify between good and bad. So thank you so much guys. Thank you. Thank you Greg. Thank you Guriy for being here today, and I wish you all the best for your future and for your current projects as well. So thank you.