Category: CleanTalk

  • Two-Factor Authentication for WordPress

    CleanTalk has launched Two-Factor Authentication for WordPress admin accounts that will improve your website security and make it safer, if not impossible, for hackers to breach your WordPress account.


    Two-Factor Authentication works via e-mail. It makes the Two-Factor Authentication more reliable. The reason is that if an intruder knows your password they also need to know your e-mail address that is being used to get an authorization code and the password to your e-mail.

    This method almost eliminates the possibility for strangers to get access to your account.


    It requires a bit of your time but Two-Factor Authentication immediately gives a much higher level of protection.


    With your first authorization, the CleanTalk Security plugin remembers your browser and you won’t have to input your authorization code every time anymore. However, if you started to use a new device or a new browser then you are required to input your authorization code. The plugin will remember your browser for 30 days.


    To activate Two-Factor Authentication go to the settings of the CleanTalk Security plugin and enable the option  “General Settings” -> “Miscellaneous” -> “Two-Factor Authentication”. The letter with your authorization code will be sent to your e-mail that you put into the general settings of your WordPress website.


    You will be notified by e-mail each time the Two-Factor Authentication was successfully passed.


    By spending a few minutes to set up Two-Factor Authentication you save your time and other resources by not having to deal with the consequences of the hacked website.


    If you have any questions, we will be happy to help you.
    You can leave a comment below or create a private ticket here.

  • Real-Time Email Address Existence Validation

    Real-Time Email Address Existence Validation

    Today we launched a new and important parameter to evaluate spambots. According to our statistics, almost 30% of all spam requests are made with fake email addresses, i.e. such addresses do not exist.

    Previously, we could only check the existence of emails after the fact and use these data in the future; now we have started checking emails in real-time.

    This new feature of CleanTalk grants the ability to check email addresses for existence in real-time.

    Non-existing email addresses also entail several other problems for website owners:
    • You can never contact them by email,
    • The client will never receive any notifications from you (account activation letter, password recovery, email distribution, notifications, etc.),
    • If you use email marketing for your clients, then a large number of nonexistent emails in the mailing list may result in your IP address being added to various blacklists of email servers.

    The anti-spam service will block all requests with not real email addresses.
    You can control such requests in the anti-spam dashboard, non-existent emails will have the “Fake email” status.

    Checking emails for existence is available for all anti-spam plugins and is included in the standard package.

    Update 05/23/2022

    Encrypted SMTP support has been added,

    Spam filtering service improved

    You can leave a comment below or create a private ticket here.
    We will be happy to answer your questions.
    How to install CleanTalk Anti-Spam on your website.
    Create an account or log in.
    Thank you!

  • CleanTalk Anti-Spam with White Label mode

    Warning! The instruction is out-of-date. The current guide can be found here.

    We have developed the White label mode to make usage of the service for hosting more comfortable and it virtually eliminates the interaction between CleanTalk and hosting clients. This option is available only for WordPress MultiSite.

    It also allows changing logos, links to your own. Your clients don’t need to get an access key, and the anti-spam logs and statistics will be available in the plugin settings, in the admin panel.

    How to enable White label Mode
    You have to edit wp-config.php in WordPress and add this code:
    define(‘APBCT_WHITELABLE’, true);
    define(‘APBCT_HOSTER_API_KEY’, ‘YOUR_HOSTER_API_KEY’);

    Where YOUR_HOSTER_API_KEY is a key from your CleanTalk’s hoster panel.

    So, you can change other details of the plugin in your CleanTalk Dashboard.

    Learn more, how to configure your own hosting service.

    Let us know if you have any questions and we will be happy to help you.
    Leave a comment below or Create a private ticket.

    Thank you!

  • How to Stop Profanity and Obscene Words on Your Website

    CleanTalk makes possible to prevent comments and messages with obscene words to appear on your website. Stop-Words Option allows blocking comments which contain words and phrases from your stop-word list. Such comments will be held for moderation. Stop-Words Option could be enabled for comments and forum posts.

    How Stop-Words Work

    If you activated Stop-Words the CleanTalk service will check texts for having words you have put in your list of forbidden words, if any of the words or phrases are detected then the comment will be sent for moderation. Checking for stop-words is available for comments and nicknames.

    Using Stop-Words to Enhance Anti-Spam Protection

    You can prevent manual spam by adding words and phrases that are being used in spam mailing. In case of manual spam there are no spambots but real human beings who visit websites and post spam comments. To know what words you should block it’s enough to look at spam mailing texts or spam comments, most likely you will see some patterns or repeatable text parts.

    How to Add Stop-Words

    The option could be enabled on your Personal Lists page. Please, follow this guide:
    https://cleantalk.org/help/stop-word

    The Stop-Words Option is included in the Extra Package. Go to your CleanTalk Control Panel to see more details.
    https://cleantalk.org/my/bill/recharge

    Please feel free to contact us anytime, we will gladly answer your questions.

    Leave a comment here or Create a private ticket.

    Thank you!

    P.S.
    We have prepared our list of stop words and you can use it completely or edit it when adding it.
    Here is a list of stop words that we have prepared to stop some of the manual spam comments.

  • CleanTalk Web Application FireWall for WordPress Security Plugin

    Hello,

    We are happy to announce CleanTalk Web Application FireWall for WordPress Security Plugin. The main purpose of WAF is to protect the Web application from unauthorized access, even if there are critical vulnerabilities.

    It allows you to protect Web applications from known and unknown attacks. Its use is transparent to all visitors to the website and does not require knowing how is HTTP working and allows very accurate filtering, supports both GET and POST methods, requests to dynamic resources.

    So, hackers use additional HTTP parameters to use vulnerabilities that allow them to get access to a website or prevent changes on your website.

    WAF catches all requests to your website and checks HTTP parameters that include: SQL Injection, Cross Site Scripting (XSS), uploading files from non-authorised users, PHP constructions/code, the presence of malicious code in the downloaded files.

    So, if HTTP request contains these parameters then this request will be blocked. The special page and reason for blocking will show for blocked requests.

    In addition to effective information security and information security applications are required to know what is quality of protection and CleanTalk is logged all blocked requests that allow you to know and analyze accurate information. You can see your Cleantalk Logs in your Control panel. https://cleantalk.org/my/logs_firewall

    CleanTalk Web Application FireWall for WordPress is the proactive defense against known and unknown vulnerabilities to prevent hacks in real-time.

    Learn more, how to set up and test
    https://cleantalk.org/help/security-waf

  • “Feedback System” for analyzing suspicious files for WordPress Security

    Hello,

    We are happy to introduce our “Feedback System” for analyzing suspicious files. This is the client-server feature in CleanTalk Security Plugin that allows sending suspicious files from WordPress backend to CleanTalk cloud.

    So, CleanTalk WordPress Security Plugin includes a Malware Scanner and there may be situations after scanning when you don’t know, is there a bad code or not, especially if you don’t have a programming experience. Well, you will be able to send some files to CleanTalk and we will check them. After checking we will send you an email notification with results.

    Please, look at our guide How file analyzes works.

  • Getting event notification on your website

    Sometimes, you want to know what is happening on your website, maybe you want to be informed when any messages are sent and were it blocked or allowed by CleanTalk Anti-Spam.

    We added a new feature to help you control for messages from your customers.

    It allows you to add a notification with some parameters:

    • Website — what website you want to receive event notifications from
    • Type of Event — what events you want to see in the notifications (Allowed, Denied, All Events)
    • Method — select where notifications should go to (E-mail or URL)
    • Periodicity (for e-mail method) — how often do you want to receive notifications (Immediately, Every hour, Every 2 hours, Every 4 hours)
    • URL (for URL method) — input your link if you chose URL option in the previous step (JSON format)

    Learn how you can set up events or change your settings.

  • BlackList by Language

    Spam spreads not only in English. Many spam messages are written in Chinese, Arabic, Japanese or Korean languages.

    If your website isn’t aimed at an international audience, and you don’t expect comments/users from other languages. For example, your website is about fishing in Ireland and you don’t want to have comments from the Chinese language.

    We added a new filter to block comment/messages by languages. That allows you to automatically block comments, messages from languages for which you have set a ban.

    At the moment, the blacklist of languages allows adding for blocking next languages:

    • Chinese
    • Korean
    • Japanese
    • Hindi
    • Arabic

    This option is useful in cases of protection from manual spam and enhances protection.

    CleanTalk informs you about the occurrence of an opportunity to manage personal black/white lists. You can view, add, and delete their items in the Control Panel. You can add languages to the blacklist in dashboard CleanTalk -> Black&White lists or use the link https://cleantalk.org/my/show_private.

  • Protection against DDoS attacks at the web applications level

    Protection against DDoS attacks at the web applications level

    As you know DDoS attacks on the site are of different intensity, it is important to the number of hosts involved in the attack, the number of network packets and the amount of data transmitted. In the most severe cases, it is possible to repel the attack only using specialized equipment and services.

    If the volume of the attack is less than the bandwidth of the network equipment and the computing power of the server (server pool) serving the site, you can try to “block” the attack without resorting to third-party services, namely to include a program filter of traffic coming to the site. This filter will filter out the traffic of bots participating in the attack, while skipping legitimate traffic of “live” site visitors.

    Scheme of software filter from DDoS attacks on the site

    The filter is based on the fact that bots participating in DDoS attacks are not able to execute JavaScript code, so bots will not go beyond the stop page of the filter, which will significantly unload the frontend/backend and the site database. Because to process each GET/POST DDoS attack request, you will need to execute no more than 20 lines of code in the backend of the site and give the page-stub of less than 2KB of data.

    1. The filter is called by the first line of the web application, before calling the rest of the application code. So it is possible maximally to unload the “hardware” of the server and reduce the amount of traffic sent to the bots.
    2. If the visitor falls under the filter conditions, then we give the visitor a special page-stub. On the page,
    • We are reporting the reasons for issuing a special page instead of the requested one
    • We set the special cookie in the user’s browser through JavaScript
    • Run JavaScript redirect code to the source page
    1. If the visitor has a special cookie, the filter transparently passes the visitor to the requested page of the site.
    2. If the visitor’s IP address belongs to an autonomous system from the list of exceptions, then the traffic is also transparently skipped. This condition is necessary to exclude the filtering of search engine bots.

    Project filter on github.com.

    Synthetic tests of the filter

    We tested ab utility from Apache Foundation on the main page of the combat site, previously removing the load from one of the nodes.

    Results with a disabled filter,

    ab -c 100 -n 1000 https://cleantalk.org/
    
    Total transferred: 27615000 bytes
    HTML transferred: 27148000 bytes
    Requests per second: 40.75 [#/sec] (mean)
    Time per request: 2454.211 [ms] (mean)
    Time per request: 24.542 [ms] (mean, across all concurrent requests)
    Transfer rate: 1098.84 [Kbytes/sec] received

    Now the same thing with the filter on,

    Total transferred: 2921000 bytes
    HTML transferred: 2783000 bytes
    Requests per second: 294.70 [#/sec] (mean)
    Time per request: 339.332 [ms] (mean)
    Time per request: 3.393 [ms] (mean, across all concurrent requests)
    Transfer rate: 840.63 [Kbytes/sec] received

    As you can see from the test results, enabling the filter allows the web server to process almost an order of magnitude more requests than without the filter. Naturally, we are talking only about requests from visitors without JavaScript support.

    Application of the filter in practice, the history of saving the site from one small DDoS attack

    Periodically, we are faced with DDoS attacks on our own corporate site https://cleantalk.org. Actually during the last of the attacks, we applied a filter from DDoS at the level of the website applications.

    The start of the attack

    The attack started at 18:10 UTC + 5 on January 18, 2018, attacked the GET with requests to the URL https://cleantalk.org/blacklists. On the network interfaces of the Front-end servers, there appeared an additional 1000-1200 kbit/second of incoming traffic, i.e. received a load of 150/second GET requests to each server, which is higher than the nominal load 5 times. As a consequence, the Load average of Front-end servers and database servers has grown dramatically. As a result, the site began to issue error 502 due to the lack of free processes php-fpm.

    • Attack analysis
    • After spending some time studying the logs, it became clear that this is the DDoS attack, because,
    • 5/6 requests were for the same URL.
    • There was no clearly defined group of IP addresses creating a load on the URL from item 1.

    CPU front-end servers were loaded an order of magnitude higher than the surge load on network interfaces.

    Accordingly, it was decided to include a filter of visitors to the site using the algorithm described above, additionally including in it the checking of incoming traffic through our database of blacklists, thereby reducing the probability of issuing a stop page to legitimate visitors to the site.

    Enabling the filter

    After spending some more time preparing the filter, it was switched on at 19:15-19:20.

    After a few minutes, we got the first positive results, first Load average returned to normal, then the load on the network interfaces fell. A few hours later, the attack was repeated twice, but its consequences were almost invisible, the frontends worked without errors 502.

    Conclusion

    As a result, by using the simplest JavaScript code, we solved the problem of filtering traffic from bots, thereby extinguishing the DDoS attack and returning the availability of the site to its regular state.

    Honestly, this bot filtering algorithm was not invented on the day of the attack described above. A few years ago, we implemented the additional function SpamFireWall to our Anti-Spam service, SpamFireWall uses more than 10 thousand websites and there is a separate article about it.

    SpamFireWall was developed primarily to deal with spam bots, but since the lists of spambots intersect with the lists of other bots used for questionable purposes, the use of SFW is quite effective, including for stopping small DDoS attacks on the site.

    About CleanTalk service

    CleanTalk is a cloud-based service for protecting websites from spambots. CleanTalk uses protection methods that are invisible to the visitors of the website. This allows you to opt out of methods of protection that require the user to prove that he is human (captcha, question-answer, etc.).

  • Validation of Email Addresses for Protection Against Spam Bots on the Website

    Validation of Email Addresses for Protection Against Spam Bots on the Website

    E-mail is still one of the most important and effective elements of online business and marketing and is the most effective channel for generating revenue. Therefore, for any online business and website owners, it is important to be sure that the email owner used it for registration/subscription so that the user used his real email address.

    There are several important reasons for this.

    First, it is important to recover the forgotten password, for example: the user has misspelled his email address, after a while used the password recovery function and cannot get a new password.

    Second, this user will not receive your email notifications.

    Third, the user whose email was used by spammer for registration/subscription will send your newsletter to spam. Further, spammers can use this email for sending spam, brute force, etc.

    The use of such emails for marketing mailings and other mailings may carry certain risks for the owner of the site and increase the risks of adding to the lists DNSBL, various blacklist’s, increase the likelihood of getting into the spam folder and your other emails. Increase your budget costs for mailing to fake addresses or addresses whose owners have been compromised by spammers.

    To avoid or minimize risks to a minimum, the list of email addresses must be checked before sending.

    Recently, we started checking the existence of email addresses, which checks if such an email address exists or not. It uses the MX records of the domain of the email address and connects to the mail servers (via SMTP, and also simulates the sending of the message) to ensure that the mailbox does exist for that user/address and it can receive mail.

    This test solves several tasks at once, reducing the likelihood of skipping spam and allowing users to check the emails of their users. To test users, you can use the API method https://cleantalk.org/help/api-spam-check.

    An example of the result of the API response for https://cleantalk.org/blacklists?record=mattressfg%40gmail.com

    {"data":
                {"ma********@***il.com":
                          {"appears":1,
                          "frequency_time_10m":0,
                          "spam_rate":"1",
                          "frequency":"8",
                          "frequency_time_24h":1,
                          "updated":"2018-03-26 00:26:48",
                                                      "exists": 0, 
                          "frequency_time_1h":1}
                }
    }

    At the moment, we use this tool only to improve spam detection and check all email addresses that have had spam activity in the last 10 minutes. For checked addresses, a flag is set in the database, which is taken into account in the further spam filtering and API response.

    “exists”: “1” – exists

    “exists”: “0” – does not exist

    You can sum up the interim results; the percentage of non-existent email addresses in the spam mailing is 25.34%.

    We collect information about spam IP/email addresses from more than 237,000 websites. The email database contains more than 10,095,239 email addresses. And in our immediate plans, check all emails in the database and run a scan of all the email addresses that are processed by the service.