Your login pages get hit by bots whether you notice or not. The Security Monitoring System watches those endpoints for you, blocks IPs that keep failing, and emails your admins when something serious happens. It runs on its own, so there is nothing to switch on.

Where to look

Open the Security Events Dashboard from the Security section in the admin sidebar.

You get five things on one page:

Security Events Trend, a 30 day line chart colour coded by severity (Critical, High, Medium, Low).
Event Type Distribution, a donut chart showing which kinds of attacks you are getting.
Recent Security Events, a table with severity, event type, description, user ID, IP, timestamp, and a Details button for the full record.
Top Attacking IPs, with event counts, attack types, and a Block button.
Blocked IPs, with the time each was blocked and an Unblock button.

Numbers refresh roughly every 30 seconds.

When the platform blocks someone by itself

Failed logins are counted per IP. Once an IP crosses the threshold (usually 5 failed attempts on the admin panel, 10 on the user panel) it gets blocked, and every active admin gets an email with the IP, the event type, the timestamp and the context.

The block covers everything: panel, API and SMPP. Active sessions from that IP are killed, auth cookies are cleared, and the visitor lands on a Forbidden page. The block stays until an admin removes it.

Protected areas are the admin login and password recovery pages, the user login and password reset, API authentication, and SMPP authentication.

Severity levels in plain terms

Critical: act now. Thresholds breached, active attacks. These trigger the email alerts.
High: worth watching. Repeated failures from one IP.
Medium: odd but not alarming on its own.
Low: routine, like a successful login after an earlier failure.

Blocking and unblocking by hand

To block: find the IP under Top Attacking IPs, click Block, confirm. It lands in the Blocked IPs table straight away, and the action is logged against your admin account.

To unblock: find it under Blocked IPs, click Unblock, confirm. Access comes back immediately. This is what you use when a client’s office IP gets caught because three of their staff fat fingered a password.

Clear Attempts

Clear Attempts at the top of the dashboard wipes the admin token tracking files, resets user login counters and removes failed login tracking. It does not unblock anything already banned. Useful after you have dealt with an incident, or while testing. Do not make a habit of it, because you lose the pattern you were tracking.

Keeping it useful

Check the dashboard at least weekly, and read the alert emails when they arrive rather than filing them. Skim the Blocked IPs list now and then so a paying client is not sitting in it unnoticed. Keep your admin email current, because only admins with Active status get the alerts.

If alerts stop arriving, check that your admin account is Active, that the email on your admin profile is right, that email is configured in general settings, and that the alerts are not landing in spam.

Found this useful?Add as Preferred Source on Google

Security Monitoring: How Automatic IP Blocking Protects Your Platform