Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company has a product which is downloadable through our website. Since day one, we've been continuously spammed by bots trying to download a little bit of content all the time (usually 4 MB out of 15).

We've tried a couple of techniques to protect ourselves, but they've all failed. We'll end up using a captcha if there's no other way around, but I'd really like to avoid hurting the download experience for our customers. I've seen numbers of websites proposing to download a piece of software without a captcha, so I'm pretty sure there's a solution.

Technically, it's a Wordpress environment, with an Apache webserver in a very simple Linux architecture.

What should we do to avoid those spammers? I'm not sure it matters, but most of the IPs come from China.

share|improve this question
Note: I couldn't add the "download" tag, so if anyone with 3000 rep could do it, thanks. – Warren Seine Mar 26 '13 at 8:19
A number of tags containing "download" have been added to the synonyms list and effectively removed from use. Go here and type in "download" to view. – jscott Mar 26 '13 at 9:22
What is the nature of this product? Why do bots want to download pieces of it? – Michael Hampton Mar 26 '13 at 12:33
@MichaelHampton It's a 3D product. There's no reason somebody would want to hurt our business. These bots definitely are random bots whose only goal is to consume bandwidth. – Warren Seine Mar 26 '13 at 17:31
This makes little sense. Botnets have better things to do - unless your business is the target. Are you sure these aren't legitimate downloads? Maybe someone is trying to bypass the Great Firewall. The more information you can provide, the more likely it is we can figure out what's going on. – Michael Hampton Mar 26 '13 at 18:21
up vote 1 down vote accepted

Simplest way to work around these kind of issues is to use a content delivery network (CDN).

Just host your downloadable content with the CDN of your choice and let them handle the load.

Otherwise, there are DDoS protection services that can protect your whole web site.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.