3

since few days, someone is sending thousands of request to a wordpress website hosted on my webserver.

A generic log line for this request is:

60.173.10.250 - - [23/Nov/2013:18:24:46 +0100] "GET /archivio/mgilbert/ HTTP/1.0" 200 24758 "http://www.**********.it/archivio/mgilbert/#comment-9768++++++++++++Result:+chosen+nickname+%22Tiedimmox%22;+nofollow+is+found;+success+%28from+first+page%29;+BB-code+not+working;" "Mozilla/5.0 (Windows NT 5.1; rv:15.0) Gecko/20100101 Firefox/15.0.1

As a result of this request, the owner of the website is receiving tons of emails. Request comes from different IP addresses, so I can't block them using IP address as filter.

Is there any way to block such requests?

1
  • 3
    Fix the underlying problem - a GET request to /archivio/mgilbert/ shouldn't be sending an e-mail to someone.
    – ceejayoz
    Nov 23, 2013 at 18:06

2 Answers 2

5

The site is being attacked by a bot, script, malware or generally something not good. The IP addresses will always change because that is how these systems work. One parent master server controls tons of infected systems across the world. And uses these infected systems to spread more & more malware.

Since you say this is a WordPress site, chances are that there is a vulnerability in the version of WordPress that is installed. If possible, that should be upgraded.

Another option is to install ModSecurity. Or if your hosting service has it in place, ask them to have it activated. ModSecurity is a great tool that acts as a web server level firewall between your Apache2 hosted website & attacks. But that said, it can be a pain to configure. And sometimes false positives can get in the way of normal operation of your website.

Past that, another good tact is to place .htaccess/.htpasswd level password protection on the wp-admin.php. The vast majority of bots out there drop dead the second they hit that password prompt & your server is safe. This might be inconvenient to anyone managing the admin of the WordPress site—since they now have to remember 2 sets of passwords—but it is a very effective way of blocking attacks.

4

if you are using nginx, you can match on any header, and return 403 (forbidden)

so for instance (off the top off my head, so check syntax)

if $user_agent =~ /Gecko/20100101 Firefox/15.0.1/ { return 403; }

on apache, you can load mod_security, but its known for lots of false positives, especially if you have lots of vhosts.

if your box is live on the internet, with a public ip, another option is to throttle incoming requests with iptables,

iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j RETURN

EDIT: as a short term solution, you could

location =~ /archivio/mgilbert { return 403; }

2
  • Not bad advice on a specific level, but the larger issue here is attacks like this can’t be stopped like this all the time. It’s like playing whack-a-mole. Nov 24, 2013 at 7:40
  • 1
    well, the throttleing can be applied globally,.... you are not chasing ip's with throttling
    – nandoP
    Nov 24, 2013 at 8:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .