I'm running a Wordpress site with Nginx, MariaDB, PHP-FPM and getting bombarded by a lot of different 404 request from a lot of IP (~10.000 different IP per hour requesting random URL which results in very high SQL load and random downtime).
I've tried to put the main server behind a different Nginx server which will do reverse proxy caching of the site to reducing load but the main server still get very high load because of 404 requests get passed the Nginx proxy caching server.
The server now making 5XX error because MYSQLD taking all the CPU to handle its stuffs thus make PHP-FPM starve and unresponsive to Nginx's request I think?
I get a lot of this in error log:
2017/05/13 03:48:40 [error] 24894#24894: *2936187 upstream timed out (110: Connection timed out) while connecting to upstream
My server having 16 core, 64GB RAM with 200GB SSD disk running Ubuntu 17.04 and MYSQLD always taking all the CPU as much as it could get.
My main server Nginx config:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 2048;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
client_max_body_size 32M;
disable_symlinks off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
gzip off;
### START SERVER CONFIG
server {
listen 80 default_server;
root /var/www/html;
index index.php index.html index.htm;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
server_name _;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass 127.0.0.1:9000;
}
location ~ /\.ht {
deny all;
}
}
### END OF SERVER CONFIG
}
PHP-FPM config:
[www]
user = www-data
group = www-data
listen = 127.0.0.1:9000
listen.owner = www-data
listen.group = www-data
listen.allowed_clients = 127.0.0.1
process.priority = -10
pm = dynamic
pm.max_children = 64
pm.start_servers = 32
pm.min_spare_servers = 2
pm.max_spare_servers = 32
Is there somehow I can improve the situation? As I said, all the request are coming from a lot of different IPs requesting a different URL with a very legit looking request (header look exactly like a browser) so I can't making any firewall rules to blocking it but I know they're automated request since there is some user-agent telling it's coming from IA64 architecture which no way any of my visitor have it.
And No, I can't use Cloudflare or similar services to prevent automated request for some reason... So is there any Nginx plugin to detect if it's a real browser load or a bot by testing javascript or similar method before allows it enter the site?