0

I have deployed WP project on a CentOS based Linux server.

I am experiencing unusual traffic (crawling) from random IP addresses hence causing very high server load (as high as average load 200).

Is there any possibility to automatically detect such requests at server and temporarily block that IP ?

I mean if server founds 100 requests from same IP within a second it should block that IP.

Please guide.

6
  • 1
  • 2
    There are iptables rate limiting modules. There's also fail2ban. It's worthwhile to use both. I'm downvoting this question because it's almost certainly been answered a million times already on this site alone. Mar 10, 2016 at 13:54
  • A combination of iptables and fail2ban might solve the problem. But we are not really sure how comprehensive this crawling is or how powerful your solution is? Have you considered Cloudflare? Mar 10, 2016 at 14:09
  • 1
    why it downvoted? what wrong with you guys? Feb 7, 2020 at 17:14
  • Instead of down voting you should flag as a duplicate question in this case. @ParthianShot Aug 7, 2020 at 10:33

3 Answers 3

1

Yes it exists and it's called fail2ban:

www.fail2ban.org

edit: let me copy the URL with the detailed solution from the comments to here:

https://security.stackexchange.com/questions/35773/how-can-i-block-an-ip-if-im-getting-many-http-requests-in-a-second

Thanks @Pit

6
  • No its not, it will only ban the ip with failed login attempts. Mar 10, 2016 at 13:35
  • @GauravPundir You can use Fail2ban for other things than just failing wp logins! But fail2ban might be a tough process running for this task. I would consider using a service like Cloudflare in this case. Mar 10, 2016 at 13:38
  • 1
    How to use fail2ban for this: security.stackexchange.com/questions/35773/…
    – Pit
    Mar 10, 2016 at 13:41
  • @GauravPundir: fail2ban does the job the OP asked for very well, see for example the comment above. It also takes care of releasing the ips after some time, and it doesn't only work for brute force attacks against wordpress but also many other services which probably run on a standard CentOS server.
    – BeerSerc
    Mar 10, 2016 at 13:49
  • Fail2ban is more of an anti-DOS solution to me. Not what OP requests: I am experiencing unusual traffic (crawling) from random IP addresses. Mar 10, 2016 at 13:55
0

We use in our company a Web-Application-Firewall Plugin called All-In-One WP Security for this task.

https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

I'd say this is an absolute must have for every WordPress site (either this plugin or any other security plugin with high security standards). We had brute force attacks on our WP Sites but were able to secure our sites with this plugin to the maximum. There are many other security options than only just IP-blocking you can set with this plugin i.e .htaccess restrictions, blacklist functions, file system security options, Firewall functionalities, malware scan and many more.

0

You can block the IP address manually by check the apache logs. You may check your log location in the configuration path for apache.

root@ping#  vi /etc/httpd/conf/httpd.conf

search for error_log in this file.

I have WHM installed in my server so in my case logs was at below defined path

root@ping#  tail -f /usr/local/apache/logs/error_log

Search the IP which is requesting continuously and block that IP address via iptables.

Iptables command to block ip address permanentely

root@ping#  iptables -I INPUT -s 1.2.3.4 -j DROP

Add your own IP at place of 1.2.3.4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .