Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an active interest in any web page(s) more than say 200 in an hour, or 15 in a minute. I am assuming that a human user cannot surf 15 pages in a minute unless he has reasons that are indeed worth suspecting.

Ideally I would like the IP Addresses to be logged into a banned databases, and also have a white listed IP Addresses for those IP Addresses belonging to my client.

Is there any ready tool which does all this. I saw fail2ban and it does not serve the purpose...

share|improve this question
What about proxies and NAT? All employees of a given office will likely come from the same public IP address. – Julien Jul 21 '11 at 15:19
up vote 7 down vote accepted

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script).

fail2ban will do what you want, with a little more work than reading the Google search tagline.

share|improve this answer
Also, be sure to white list search engine's bots. You can use a /robots.txt file to tell them what not to index. – Chris Nava Jul 21 '11 at 14:34

How about using existing services such as Project Honeypot?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.