How to prevent a DDoS attack on my WordPress website

A

Arsh1219

Junior Member
Joined
Nov 20, 2015
Messages
105
Reaction score
27
Someone has been making a DDOS attack on my WordPress website for the past few days.
He is sending requests to my website URLs like: domain.com/32hui42hiu45/
domain.com/ewrerih21334/
domain.com/?s=oijiueh
domain.com/?s=retegtrew

they are sending requests to random URLs requires database query, causing the website to check the database and flood server resources.
Currently, I am using Cloudflare security to check javascript detection in the browser, this is not a good solution, because of bad user experience. Some users might just hit back after seeing that page.

The requests are coming from different IPs, country matching with the most users in my country. I tried to track it via nginx logs, they are using different ips on every requests, different user agent. I cant find any pattern to block them. any third party service can help me block this attack? i don't want to use cloudflare's javascript detection, which shows a message "Checking if your connection is secure" then waits until few seconds before loading the page...
 
Advertise on BHW
It's going to take some work, getting familiar with regex, and be a bit of cat & mouse game.
CF does have Security >> WAF >> Custom rules. Which you could create custom rules to single out the bad requests, then Action to do javascript detection to block for only those.

You mentioned not being able to spot a pattern. But in the urls provided, a pattern seen for the first 2 are that they are exactly 13 characters long.
E.g. Untested, but a custom CF rule could then be formulated like (http.request.uri eq "/[a-zA-Z0-9]{13}/") to Action on blocking/js challenge.

Then moving on to the next new rule, that match searche-like uri's patterns on the site: /?s=
 
Ah, I did not know its possible to use regex. Thank you for your response. The DDoS attack is on different lengths always, not exactly 13. But this was good to know I can use regex with it. Would surely help me, thank you.
 
The big question is, how are they sending different requests from different IPs? I have never imagined sending DDoS from different real IPs is possible. Do you have any idea? Because every IP is making almost 3-6 requests max in an hour.
 
Arsh1219 said:
The big question is, how are they sending different requests from different IPs? I have never imagined sending DDoS from different real IPs is possible. Do you have any idea? Because every IP is making almost 3-6 requests max in an hour.
Click to expand...
Proxies.
 
Arsh1219 said:
The big question is, how are they sending different requests from different IPs? I have never imagined sending DDoS from different real IPs is possible. Do you have any idea? Because every IP is making almost 3-6 requests max in an hour.
Click to expand...

That's exactly how DDoS works. They use countless different IPs

You need Cloudflare protection as others mentioned
 
Arsh1219 said:
Currently, I am using Cloudflare security to check javascript detection in the browser, this is not a good solution, because of bad user experience. Some users might just hit back after seeing that page.
Click to expand...
Real users with a 0% bot detection score will not see any such captchas. Use the highest security level on Cloudflare. You can even enable "under attack mode". It's the easiest way to quickly solve the issue.
 
Hi, I had similar problems. I use a waf that I pay 15 dollars a month. i bought anindahosting waf the attacks stopped. I recommend it.
Cloudflare unfortunately cannot prevent it.
1686717161568.png

1686717188288.png
 
The regex is only available in cloudflare business plan or higher.
 
Damn, could've sworn I had tried regex on a free plan before. I guess it's not free anymore.
 
Funny that this is a thing with turdpress. Every request queries the database...smh. If you know PHP you can filter it by loading all valid IDs into an array, then refusing all requests that are not on the list before even loading the page, just by returning a 404 error. Chances are your turdpress site only has a few valid IDs, and by ID I mean the content/page that is associated with a particular URL.

Furthermore, you should be returning 404 errors to any improperly formatted URL without even touching the DB.

If they are hitting your search, i.e. the equivalent of someone typing random stuff into "search" on your website and POSTing it, you'll have to get a bit more creative. Most of the time they'll just send the query without loading the page, so you can have simple hash/session check, which denies requests from hosts that do not supply the proper session hash at the time of the request. The hash should change with each page load. The drawback here is that if they want to mess with you they can easily get around this check by loading the page then sending the bogus request.

Best bet is to stop using turdpress. It is perhaps the worst example of php bloatware that exists.
 
If you use Cloudfare you must configure it, but in case you don't even solve it with cloudfare, I designed a script for customers who also had this type of problem, and DDoS attacks began to decrease by 5% daily, to the point where it stopped completely. It depends on the type of place you have, it could also serve you.
 
In my previous experience, I temporary blocked/challenge other country except my major traffic country. this can be done on free plan of cf. It solves mine.
 
Exxtra said:
Funny that this is a thing with turdpress. Every request queries the database...smh. If you know PHP you can filter it by loading all valid IDs into an array, then refusing all requests that are not on the list before even loading the page, just by returning a 404 error. Chances are your turdpress site only has a few valid IDs, and by ID I mean the content/page that is associated with a particular URL.

Furthermore, you should be returning 404 errors to any improperly formatted URL without even touching the DB.

If they are hitting your search, i.e. the equivalent of someone typing random stuff into "search" on your website and POSTing it, you'll have to get a bit more creative. Most of the time they'll just send the query without loading the page, so you can have simple hash/session check, which denies requests from hosts that do not supply the proper session hash at the time of the request. The hash should change with each page load. The drawback here is that if they want to mess with you they can easily get around this check by loading the page then sending the bogus request.

Best bet is to stop using turdpress. It is perhaps the worst example of php bloatware that exists.
Click to expand...
so what do you recommend am using ghost for now
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top