0

Our website is being constantly attacked by the bots. We tried mod_evasive and mode_security but those modules slowed our server considerably. Can anybody please suggest more solutions. Thanks in advance.

closed as off-topic by EEAA, yoonix, peterh, mdpc, masegaloeh Apr 30 '15 at 2:12

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Use a CDN like Cloudflare or Akamai. Or upgrade to an (expensive) webhost that offers some sort of DDoS protection. – EEAA Apr 29 '15 at 17:24
  • What do you mean by (D)DoS ? Do you mean a layer 7 attack (HTTP request flood) or simple bandwidth exhaustion attack ? You can fight an L7 attack by configuring your server to rate limit incoming requests and switching to a better web server like Nginx which is more efficient and immune to some attacks like Slowloris. – user186340 Apr 29 '15 at 18:52
1

There is almost nothing you can do on your site to defend from DDoS. Essentially when malicious traffic reaches your site it is already too late to do anything. Your best chance to defend yourself is by using third party provider. There are several of them offering different features for different budgets but you could start with Incapsula or Cloudflare.

  • This is only correct for bandwidth-exhaustion attacks. If the malicious traffic doesn't overload the server's network connection, you can resist the attack by rate-limiting requests at the firewall or web server level. – user186340 Apr 29 '15 at 18:57
  • @AndréDaniel: Rate limiting is resource consuming by itself since you need to somehow keep track of the source address. It may work against amateur attack from a single host but it would be inefficient against a bot net. – dtoubelis Apr 29 '15 at 19:37
  • It depends on the size of the botnet. But before paying a third-party it may be a good idea to at least try the solutions I mentioned - the DDoS may be "amateur enough" to be blockable with simple IPtables rules on the server itself. – user186340 Apr 29 '15 at 19:41
  • @AndréDaniel: The reason I suggested these two providers is that they have a free tier. – dtoubelis Apr 29 '15 at 19:46
  • Even then, it's better to try and mitigate the attack yourself (by using a more efficient web server, IPtables, etc) before going to a third-party. Note that this question lacks many details on what the attack actually is so what I'm saying is pure speculation. – user186340 Apr 29 '15 at 19:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.