In the RK-CMS website management system, we've certainly taken security into account. One of the main threats to any website is brute force. Simply put, this is when an attacker (or bot) tries to guess your username and password, trying thousands of combinations to break into your account.
We've created protection that blocks such attempts. Let me explain how it works and why we chose this approach.
What does this look like to the average person?
It's simple. You visit the website and try to log in to the admin panel or your personal account.
If you enter a password incorrectly several times in a row (for example, 5 times), we temporarily block you from trying again.
This isn't permanent. Wait a little while (for example, 15 minutes), and you can try again. This is necessary to stop the program from trying passwords at an incredibly high rate.
What's our trick: We look at the IP and the user
Many security systems are guilty of monitoring only the user.
Their logic is: "If someone enters the wrong password for the admin user five times, let's block the admin user."
Sounds logical, but in reality, it's a trap.
Why is blocking only by user bad?
Imagine an attacker knows your login (and it's often easy to find out). They're not trying to hack you, they're trying to block you.
They deliberately go to the login page and enter your login five times with a knowingly incorrect password.
The system detects the errors and blocks your account.
Result: You, the real owner, visit the website, enter the correct password, but you can't log in! You've been blocked through no fault of your own. An attacker could do this every day, and you'd never be able to access your website. This is called a DoS attack (denial of service attack).
Our solution: Double protection
At RK-CMS, we've taken a smarter approach. Our system remembers not only who they're trying to hack, but also where they're trying to hack from.
IP blocking. We look at the computer's IP address (IP) from which login attempts are made. If the same IP address is used to try to guess passwords for different users or for the same one, we block that IP address. The thief's access is blocked, but you can still access your website from your home or work computer.
Login + IP pairing. If someone enters a specific login and makes a mistake, we remember that they tried to hack that login from that IP address. This allows us to accurately identify the attackers.
What's the benefit?
You can't suffer because some thief decides to troll you and enter your login with an incorrect password. Even if they try to block you, we'll see that the attack is coming from their computer and block them, not you.
Thus, brute-force protection in RK-CMS operates on two levels, ensuring not only security from hacking but also access stability for the true website owner.
