Sites are always under attack. You get used to it

A client rang me last year, thoroughly rattled. Their hosting panel was showing several thousand blocked requests against the login page overnight, and they wanted to know who they'd upset.

Nobody. That's nearly always the answer.

If you run a website, something is probing it right now. It was being probed the day it launched, before anyone had linked to it and before it appeared in Google. Automated scanners work through IP ranges and public certificate logs looking for anything that answers, and yours answered. There's no intent behind it at all.

Twenty-odd years of running sites for other people has left me with a fairly settled view of this. Most of what arrives at a mid-market e-commerce site is untargeted noise, bouncing off ordinary defences and leaving nothing behind but log entries. There's a great deal more of it than there used to be, and that's the part worth understanding.

What's actually changed

Volume, mainly. The techniques are largely the ones we were seeing a decade ago.

Imperva and Thales publish an annual count drawn from their global network. The 2026 edition put automated traffic at 53% of all web traffic during 2025, with bad bots specifically at 40%, up from 37% the year before. Seventh consecutive year that share has grown. They blocked 17.2 trillion bot requests over the twelve months. Cloudflare, measuring a different network, reports blocking somewhere around 230 billion threats on an average day.

Vendor telemetry from vendor networks, so treat the precision with some suspicion. The direction of travel is clear enough.

The cause is the one you'd guess. The NCSC has been fairly blunt that AI lowers the barrier to entry, and that the people who gain most are the ones who previously had very little capability at all. James Babbage at the National Crime Agency framed it as AI services increasing the raw number of criminals while improving the scale and speed of methods that already existed. Difficult attacks still need people who know what they're doing, but everything beneath that line is now within reach of anyone with an afternoon and a chatbot.

So the population of people idly poking at websites has grown, and each of them can poke faster.

The bit I'd push back on

There's a comforting version of this story where it's all curious teenagers and people learning. I've told clients that version myself, and it's half right at best.

Plenty of it genuinely is amateur. Somebody following a tutorial, running a scanner they don't understand against a target chosen at random. It bounces off and nobody notices.

E-commerce also attracts a category of automation that's curious about nothing at all. Card testing, where small transactions validate stolen card numbers before the real spending starts, hits roughly a third of global merchants according to Mastercard's research. Credential stuffing takes leaked passwords from somebody else's breach and tries them against your customer accounts, while scrapers lift your pricing for competitors and grey-market resellers. Retail leads every sector for business logic abuse in Imperva's figures, at 24% of recorded incidents.

Commercial crime, running at industrial scale. The bearable part is that it's indiscriminate, and that's the reassurance worth giving a client, since it survives them going away and reading about it afterwards. Your site is on a list, and the list is very long.

Nobody is stealing card numbers from your checkout

Card testing is the one that frightens clients most, so it's worth being precise about what it achieves.

On any checkout built in the last few years, the card fields belong to your payment provider. Stripe Elements and its equivalents render the inputs inside an iframe served from the provider's own domain, styled to sit invisibly within your page. Your customer types into a form that looks like part of your site, and the number goes straight from their browser to the processor. It never lands on your infrastructure at all. This changed quietly over the years, and a lot of clients haven't caught up. Somebody hammering your checkout with stolen card numbers is running them against Stripe, and your site is the doorway they happened to walk through.

It still costs you, mind. You'll wear the authorisation fees, and enough of it earns an uncomfortable conversation with your processor about risk scoring.

The iframe protects the card number, not the page around it. PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 became mandatory in March 2025, and they exist because skimming scripts attack the page surrounding the payment field. Even on SAQ A with a fully hosted form, the script inventory and the tamper detection on that page are yours to own. Most merchants I speak to assume Stripe's Level 1 certification covers it. It covers Stripe.

Where the cheap wins are

Cheap, mostly. Cheap enough that cost rarely comes up in the conversation. Most of the improvement here amounts to an afternoon's work plus a subscription smaller than a client's monthly hosting bill.

Put a CDN and WAF in front of the origin. Cloudflare's free tier gives you unmetered DDoS mitigation and universal TLS, plus the managed rulesets, which between them handle the bulk of the background noise. Be realistic about the ceiling. Free gets you one rate limiting rule on a ten-second window keyed to IP only, and five custom rules with no regular expressions and no log-only action. The missing log-only action is the one that bites. It's how you tune a rule safely before it starts blocking real customers, and it sits behind the paid tiers. Twenty dollars a month to get it back is an easy conversation to have.

Front Door is the natural fit if you're already hosting on Azure, but price it honestly. Standard is around $35 a month and gives you custom WAF rules only. The managed rule sets and bot protection everyone assumes they're buying live in Premium at roughly $330 a month, before request and egress charges. Across a large estate the step up pays for itself. Below that, most people are buying rules nobody will ever get round to tuning.

Rate limit the endpoints that cost you something when they're abused. Login, password reset, search, and anything that talks to the ERP or sends an email. Four attempts a minute on a login form irritates nobody who's forgotten their password, and it makes credential stuffing economically pointless.

Then the boring one.

You cannot reason about traffic you can't see, and most sites are flying blind. Turn logging on and ship it somewhere you can query. Then set one alert on something you'd want waking up for. Plenty of agencies have logs sitting in a folder nobody has opened since go-live.

Application Insights is the path of least resistance for anything on Azure and .NET, and the first 5GB a month costs nothing, which covers a surprising number of mid-market sites before you start paying by the gigabyte. Seq is hard to beat for structured application logging where you want to interrogate the detail. Self-hosted, free for a single user, a few hundred a year for a team, and the query language makes hunting through a bad afternoon a lot less painful. Datadog does everything better and will happily cost more than the site earns if you point it at everything without thinking, since the per-host and per-gigabyte charges compound fast. Whatever you pick, start from the questions you'll want answered at 3am and work backwards to what you collect.

Catching an attack in progress is not the goal, and it rarely happens anyway. The value shows up later, when something odd happens and you can answer "when did this start" in ten minutes instead of three days.

Patch on a schedule you keep. The gap between a vulnerability being published and being scanned for at scale is now measured in hours, and automated reconnaissance is the part of the process AI has improved most.

What I'd avoid

Enterprise bot management for a £2m-turnover B2B wholesaler. The tooling is excellent and the pricing assumes a fraud team who'll sit and use it. Most mid-market businesses would get more security per pound out of fixing their patching cadence.

Publishing your stack. Case studies and job adverts leak more than people realise.

A client's first look at their own logs shouldn't be a panic, either. Show them early, in a calm month, so the number arrives with a baseline attached.

The short version

Your site is under attack, it always has been, and that fact carries almost no information about your business. The volume has grown because the tooling got cheap. A CDN, rate limits on the endpoints that cost you something, monitoring somebody reads, and a patching schedule you keep will handle the overwhelming majority of it.

The rest is weather. You get used to it, and eventually you stop looking at the number.

If you want a view on what's currently sitting in front of your site, it's a conversation we have fairly often.