⚠ Security Advisory

Your FileMaker Server
Is Under Attack Right Now

FileMaker Server has no built-in protection against brute-force login attacks. We've seen servers receiving hundreds of attempts every single day — and most owners have no idea it's happening.

Talk to Us About Hardening Your Server →
2,200+
Cyberattacks occur globally
every single day
500+
Failed login attempts we've seen
on a single FileMaker server in one day
0
Built-in brute-force protections
in FileMaker Server
The Threat is Real

High-profile breaches are making headlines.
Smaller businesses are next.

Recent months have seen devastating cyberattacks on some of the UK's most recognisable brands. These aren't isolated incidents — they're a sign of a threat landscape that's becoming more aggressive, more automated, and harder to ignore.

Jaguar Land Rover
Internal documents, source code, and sensitive employee data stolen and published online by a ransomware group. Data included confidential project files and personally identifiable information.
Data Exfiltration
Marks & Spencer
A significant cyberattack disrupted online operations, affected customer services, and caused widespread operational disruption across one of the UK's largest retailers.
Operational Disruption
Co-op
Customer data including names and contact details were accessed by attackers, forcing the Co-op to take systems offline and notify the ICO. Member data was confirmed compromised.
Customer Data Breach

These attacks targeted large enterprises with dedicated security teams and significant IT budgets. The reality is that automated attack tools don't discriminate — they scan the entire internet continuously, probing every accessible server for weaknesses.

Through our improved server monitoring, we've discovered something concerning: FileMaker servers are more vulnerable than most people realise. We're seeing thousands of failed login attempts per week on servers we manage — automated bots systematically trying username and password combinations around the clock.

The critical gap: FileMaker Server has no native mechanism to detect, throttle, or block repeated failed login attempts. A brute-force attack can run indefinitely against a FileMaker server without triggering any built-in response. This isn't a configuration problem — it's a gap in the product itself.

Our standard hosting service covers server installation, FileMaker setup, annual updates, and general monitoring. Closing this security gap requires additional measures — which is what this package provides.

What we're seeing on managed servers
3,500+
Failed FileMaker login attempts recorded on a single server in one week — all from automated bots
24/7
Attacks don't follow business hours — probing continues overnight, weekends, and bank holidays
0
Native FileMaker Server responses to repeated failed login attempts — none, by design
Understanding the Gap

What standard hosting covers — and what it doesn't

Our standard managed hosting is comprehensive — but enhanced security goes beyond that scope. Here's an honest breakdown.

✓ Included in standard hosting
🖥️Server OS installation and configuration
📦FileMaker Server installation and setup
🔄One FileMaker update per year
📊General server monitoring and uptime alerts
💾Daily automated backups
🇬🇧UK-based support and account management
✗ Not included — requires hardening package
🚫Brute-force attack detection and blocking
🔥Advanced firewall configuration
📋Ongoing login and access log review
🛡️Active security incident response
🗃️Client backup portal with on-demand access
⚡Prompt FileMaker updates (Enhanced tier)
The Solution

What we put in place

Server hardening applies a layered set of protections that significantly raise the barrier for attackers — turning your FileMaker server from an easy target into a hardened system.

🛡️
Fail2Ban with Intelligent Login Throttling
Failed login attempts are actively tracked at the OS level. Repeated failures trigger automatic blocks — closing the gap that FileMaker Server itself leaves open.
More than four failures from the same IP within a ten-minute window triggers a one-hour automatic block. Persistent attackers are permanently banned.
🔒
Firewall Configuration
Tightly controls which connections are permitted to reach your server. Only the ports your FileMaker solution actually requires are open — everything else is shut.
Reduces your server's exposure surface significantly, blocking opportunistic scans before they reach FileMaker Server at all.
📋
Ongoing Login Monitoring
We review access logs on an ongoing basis — identifying unusual patterns, new attack vectors, and emerging threats before they become incidents.
This is the difference between finding out about an attack after the fact, and catching it early enough to respond.
⚙️
System Hardening
A range of best-practice measures applied to reduce your server's attack surface — closing common vulnerabilities and tightening OS-level configuration.
We're also working towards Cyber Essentials certification — the UK government-backed cybersecurity standard — to further validate our approach.
Go deeper
Exactly what we harden — every check explained

A plain-English breakdown of every security measure we apply, how a server arrives before we touch it, and why a secured server is a service in its own right.

See what we secure →
✦ Exclusive to hardening package clients

Your Own Client
Backup Portal

Every hardening package client gets access to our secure client portal — a simple, private dashboard where you can browse, download, and trigger your own FileMaker backups, whenever you need them.

📁
Browse your backups — see exactly what's backed up and when, without having to contact us.
⬇️
Download on demand — retrieve any backup file directly, any time of day.
▶️
Trigger backups yourself — run an on-demand backup before a major change, without waiting for the scheduled run.
🗓️
Extended offsite history — backups are retained on our external system for a minimum of 7 days after FileMaker Server's own housekeeping removes them.
FM Hosting UK — Backup Portal
📄 MyDatabase_2026-04-02_0200.fmp12 Today 02:00 Download
📄 MyDatabase_2026-04-01_0200.fmp12 Yesterday Download
📄 MyDatabase_2026-03-31_0200.fmp12 31 Mar Download
📄 MyDatabase_2026-03-30_0200.fmp12 30 Mar Download
📄 MyDatabase_2026-03-29_0200.fmp12 29 Mar Download
Investment

Simple, transparent pricing

The one-off setup fee covers our time to install, configure, and harden your server. The monthly fee covers your ongoing monitoring, log review, and client backup portal access. No hidden extras.

One-off setup fee — all tiers
£300

Covers installation, configuration, and initial server hardening. A re-hardening service is recommended every 18 months at the same rate — keeping your defences current as the threat landscape evolves.

Get Started →
★ Standard
Standard
£35 / month
£720 total in first year (inc. setup) · Payable by Direct Debit
Includes
✓Fail2Ban installation and configuration
✓Firewall setup and management
✓Ongoing access log review
✓Fail2Ban rule updates as threats evolve
✓Security incident response
✓Client backup portal access
✓7-day extended offsite backup retention
Get started with Standard →
Cancel anytime with 30 days notice
✦ Enhanced
Enhanced
£95 / month
£1,440 total in first year (inc. setup) · Payable by Direct Debit
Everything in Standard, plus
✓Fail2Ban installation and configuration
✓Firewall setup and management
✓Ongoing access log review
✓Security incident response
✓Client backup portal access
✦Prompt FileMaker Server updates — every release
✦Saves up to £300 per update vs. ad-hoc pricing
✦Closes known vulnerabilities as soon as fixes are released
Get started with Enhanced →
Cancel anytime with 30 days notice
Why FileMaker updates matter for security

Claris has released five FileMaker Server updates in the past year alone, each containing important security fixes. Without the Enhanced tier, updates are charged at our standard rate — meaning known vulnerabilities may remain unpatched for longer. The Enhanced tier ensures your server is upgraded promptly every time a new release is available, closing security gaps before they can be exploited.

Ready to harden your server?

Get in touch and we'll walk you through everything — no jargon, no pressure.

Sign Up Now →