Since yesterday, there has been a significant increase in the views of 404 pages in Google Analytics' real-time statistics. This is a rare occurrence, and it was suspected that there were abnormal page requests. Measures such as checking and blocking the IP addresses involved were taken, but the problem was not resolved.
This WordPress site is hosted on Cloudways, where it is possible to check the IP addresses and requested pages that generate a lot of traffic. If a visitor is suspected of being abnormal, access can be blocked by adding code to the .htaccess file.
In cases where there is an increase in attempts to access URLs in the format of /ws/number/shalashala, such as /ws/003/kwhc15ne/websocket, the Chrome extension program called Ubersuggest - SEO and Keyword Discovery might be the cause of the issue. If this extension program is installed in a visitor's Chrome browser, it will continuously attempt to access URLs in the format of /ws/number/… from that visitor's browser.
Increase in 404 Page Requests
When accessing a non-existent page on a WordPress site, a 404 Page Not Found page is displayed.
In the real-time statistics page of Google Analytics, there has been a strange occurrence where the views for the "Page not found" page have exceeded 40 to 50 times in the last 30 minutes.
I activated the 404 Monitor module of the Rank Math SEO plugin to check.
It was continuously attempting to access paths in the format of /ws/003/20hg1xec/eventsource, such as ws/number/…
Cloudways: Monitoring IP Request Traffic and Blocking IPs
In cases where there are continuous requests for strange pages like mentioned above, it's possible to consider checking and blocking the corresponding IP addresses. While these may disappear after a few days, if they do not, it would be wise to identify the problematic IP addresses and take action.
If you are using a web hosting service that does not offer visitor traffic monitoring, you can contact the hosting provider to request the identification of the problem IP addresses. The hosting provider will then check the visitor logs and identify the top visitor IP addresses.
When using Cloudways, you can check the IP request statistics on the monitoring page. If you want to see the visitor IP addresses and request URLs, go to the application management page and navigate to Monitoring » Analytics » Traffic.
In the IP Requests tab, you can check the list of most accessed IP addresses and the URLs they have accessed.
If an IP address is deemed abnormal, you can add code to the .htaccess file to block that IP address.
<Limit GET POST>
Order Allow,Deny
Deny from IP-Address-1
Deny from IP-Address-2
...
Allow from all
</Limit>Cause of the Increase in 404 Page Views Due to Attempts to Access the ws Folder
After blocking IP addresses in this manner, the number of strange URL requests such as /ws/003/va4qjw3w decreased, but then started to increase again.
Interestingly, requests to such URLs were consistently occurring from my own IP address as well.
Suspecting a malware infection, I conducted a malware scan, but nothing unusual was found. I even contacted Cloudways for advice, and they suggested activating Wordfence's firewall and blocking the IP addresses, which I did.
Despite these measures, the problem persisted, leading me to suspect that a banking app or a Chrome browser extension might be causing the issue. Removing the banking program did not solve the problem, but disabling a Chrome browser extension for keyword analysis called Ubersuggest stopped the issue from occurring.
When this extension is active, it causes the Chrome browser to continuously attempt to access URLs in the ws folder, leading to ERR_CONNECTION_REFUSED errors.
If this phenomenon repeats, my IP address could potentially be blocked from the site.
I have deleted the Ubersuggest extension. Now, the ERR_CONNECTION_REFUSED error is no longer occurring in my Chrome browser. However, this error may occur when visiting sites on computers where this extension is installed.
Testing revealed that this error occurs not only on WordPress sites but also on the Google homepage.
It may be a temporary error, but you might consider deleting the Ubersuggest extension for the time being.