WordPress access & attack monitor
Access records and selected attack-pattern findings from this dedicated test site.
This demo records up to 300 suspicious-request and failed-sign-in records for 24 hours, starting with this monitor version. Identical source/type/outcome records are coalesced for one minute. These are not total attacks or unique people.
World map of WordPress access logs
Filtered anonymous requests processed by WordPress. Routine GET/HEAD refreshes of this monitor API are excluded. General/unclassified traffic, search candidates and attributed stops are counted separately. Static files, hosting-level rejections and signed-in users are excluded. SSH authentication logs are unavailable on this hosting account.
These three filtered request counts are mutually exclusive. General/unclassified does not mean verified safe. Routine monitor refreshes are not attack events; verification page views can appear as general traffic.
Before correction: monitor refreshes included — 0
Preserved for reference, excluded from the corrected map and totals. The old data has no request paths, so we cannot determine or subtract exactly how many were refreshes. These are not attack counts. Rows from old data are labelled in the outcome table.
Categories are inferred from request paths and do not establish an attack. No passwords or file contents are examined by this access logger. Locations are estimates, not a person’s identity. Blue: HTTP 1xx–3xx; orange: 4xx–5xx (not proof of blocking). Curves illustrate records, not actual network routes. The destination is a representative point in Japan. Unknown locations stay unknown. IP lookup is local; no IPs are published or sent to a geolocation API. IP Geolocation by DB-IP (Lite 2026-11 / CC BY 4.0) · Natural Earth
Stored records by hour
What was attempted and what happened
Recent search candidates, matched input patterns, sign-in failures and observed outcomes. These are not confirmed attacks. Defence logs and minute-level access aggregates are separate sources and may describe the same request; do not sum their counts. HTTP 200 does not establish intrusion, and 403/404/429 alone do not prove that SafeGuard blocked an attack. SSH results are unavailable.
| Time (JST) | Estimated source | Evidence source | Possible activity and intent | Observed result | Count / unit |
|---|
No search-candidate or detection records are currently retained. Ordinary visits are shown on the access map. This does not establish safety. Use the labelled display sample to see examples.
Actual data refreshes every 30 seconds. Times are displayed in Japan Standard Time.
What this screen covers
Only selected patterns in requests reaching SafeGuard inside WordPress are covered. Server-side WAF blocks, SSH attempts and successful intrusion are not measured here. The temporary restriction covers requests reaching WordPress, not static files or the server firewall. Ten failed sign-ins or three separately retained pattern records per source within 15 minutes trigger a 15-minute restriction on subsequent requests. Signed-in users are excluded. Shared networks may be affected; false positives are possible. No IPs, usernames, full URLs, query strings, raw input, credentials or recovery keys are published. Only allowlisted normalized public paths can be displayed; unknown paths remain unknown. A keyed IP digest is held privately with records for up to 24 hours; temporary counters expire after 15 minutes unless a restriction remains active. This demo companion is separate from the customer plugin.
About this test site
Dedicated demo WordPress and database on ColorfulBox. No customer content or payment data. Protection and recovery still require operating conditions, setup and testing. Updates and backups remain necessary.
English product page →JAFA SafeGuard / Dedicated test site / No guarantee of attack prevention or successful recovery.