0

I am getting a lot of POST requests to my server that look like this.

5.113.41.160 - - [20/Jun/2016:16:05:20 -0400] "POST / HTTP/1.1" 200 9451 "-" "-"
46.52.87.170 - - [20/Jun/2016:16:05:27 -0400] "POST / HTTP/1.1" 200 9507 "-" "-"
125.108.136.161 - - [20/Jun/2016:16:05:27 -0400] "POST / HTTP/1.1" 200 9451 "-" "-"
125.108.136.161 - - [20/Jun/2016:16:05:28 -0400] "POST / HTTP/1.1" 200 9451 "-" "-"
203.87.144.9 - - [20/Jun/2016:16:05:38 -0400] "-" 408 0 "-" "-"

Is this something that I should be concerned about? The requests keep coming from random IPs but they are all to the root path and they are all HTTP POST requests.

Is there a trick that I can do in my htaccess file to reject these requests?

1
  • You can easily set a variable using SetEnvIf if the method is anything other than GET and block it, redirect it, or do other things with it. This assumes you have a well known structure on your site for where posting should be permitted and by whom. The apache docs show how to use environment variables to change the behavior of the site. Should you be concerned? Perhaps, if they are making changes to your site that you don't expect to be allowed. You didn't provide enough details for anyone to make an informed decision around that.
    – Aaron
    Jun 20, 2016 at 22:10

1 Answer 1

0

It's not harmful, but it wastes bandwidth. You could try the technique in this question.

If the IPs repeat you can obviously block by IP.

Additionally, putting CloudFlare (free or paid) in front of the website might prevent some of the requests coming through, if CF has identified them as security issues. This is probably not going to help, but won't hurt either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.