I noticed something unusual on one of my blogs today.
There was a sudden spike in traffic that didn’t look like the normal traffic I usually get. At first, I thought it could simply be a good day for the blog, but something didn’t feel right.
So I opened Google Analytics to investigate.
What I saw immediately caught my attention.
A significant amount of the traffic was coming from Singapore and Brazil, which wasn’t consistent with the usual traffic pattern of the blog. I also noticed that a large portion of the traffic was coming from desktop devices.
The traffic didn’t seem to match the content on the website either.
That was when I started looking at it from a security perspective.
The Traffic Spike
As a blogger, I regularly check my website analytics. Traffic spikes are not necessarily a bad thing. Sometimes a post gets picked up, a search query starts trending, or visitors come from a new source.
But this particular spike was different.
The countries showing the unusual activity stood out, and the traffic pattern didn’t make much sense when compared with the normal audience of the blog.
I took screenshots of the Google Analytics data so I could keep a record of what I was seeing.
This is one thing I have come to appreciate from learning cybersecurity. You don’t always start with a clear answer. Sometimes, you start by noticing that something doesn’t look normal.
In this case, the unusual traffic was the first indicator.
Checking the Website Protection
The blog is already protected by Cloudflare, so I logged into my Cloudflare dashboard to see what defensive options were available.
Instead of simply watching the traffic continue, I decided to put some additional controls in place.
I created custom firewall rules to block traffic from the countries where I was seeing the suspicious activity.
I also enabled Under Attack Mode in Cloudflare.
Under Attack Mode adds an additional security check for visitors before they can access the website. The idea is to help Cloudflare identify and challenge traffic that may be automated or malicious.
This gave me another layer of protection while I monitored what was happening.
Why I Did Not Ignore the Traffic
It is easy to look at traffic numbers and think that more visitors are always better.
For a blogger, traffic is important. It can mean more readers, more engagement and potentially more advertising revenue.
But not every visit is a real visitor.
Automated traffic can affect analytics data and make it harder to understand what is actually happening on a website. Depending on the situation, unwanted automated requests can also put unnecessary pressure on a website or become part of a larger security problem.
That is why simply seeing a traffic spike is not enough.
You have to ask questions.
Where is the traffic coming from?
What pages are being accessed?
Are the visitors behaving like normal users?
What devices are they using?
Is the traffic consistent with the website’s normal audience?
These were some of the things I was thinking about while looking through the data.
From Blogging to Cybersecurity
This experience was interesting to me because cybersecurity is something I am currently taking more seriously as a career path.
I am working toward becoming a SOC Analyst, and one of the things that interests me about security operations is the process of identifying unusual activity, investigating what is happening and responding appropriately.
Today, I got to experience a small version of that process on one of my own websites.
I noticed an anomaly.
I investigated the traffic.
I looked at where it was coming from.
I identified a pattern that didn’t match my normal traffic.
Then I used the security controls available through Cloudflare to respond.
It wasn’t a complicated security operation, but it was a useful real-world experience.
What This Experience Taught Me
One thing this experience reminded me of is that cybersecurity is not only about what happens inside large companies.
A personal blog can also experience suspicious activity.
As website owners, we often focus heavily on content, SEO, traffic and monetization. Security can easily become something we think about later.
But having basic security controls already in place can make a difference.
In my case, having Cloudflare protecting the website meant I already had access to tools that could help me respond when I noticed unusual traffic.
I also learned another important lesson.
Visibility matters.
If I wasn’t checking my analytics, I might not have noticed the unusual traffic as quickly.
Tools such as Google Analytics can help you understand what is happening with your website from a traffic perspective, while services such as Cloudflare can provide additional security and traffic management controls.
They serve different purposes, but together they can give you a better picture of what is happening.
Still Learning
I don’t want to present this as if I suddenly became a security expert because of one incident.
I’m still learning.
But experiences like this make the things I’m learning in cybersecurity more practical.
Instead of only reading about suspicious traffic, security controls and incident response, I can sometimes see similar concepts happening around something I already work with every day.
That is one of the things I enjoy about combining my blogging experience with my cybersecurity journey.
Today, I was checking my blog as a blogger.
A few minutes later, I was investigating unusual traffic and applying defensive controls.
And honestly, that’s the kind of practical experience I want to keep building as I work toward my goal of becoming a SOC Analyst.
