Today and in the past few days I’ve been often flooded with POST requests that look like this:
126.96.36.199 - - [02/Sep/2014:18:36:17 +0200] "POST /wp-login.php HTTP/1.0" 302 0 "-" "-" 188.8.131.52 - - [02/Sep/2014:18:36:19 +0200] "POST /wp-login.php HTTP/1.0" 302 0 "-" "-" 184.108.40.206 - - [02/Sep/2014:18:36:32 +0200] "POST /wp-login.php HTTP/1.0" 302 0 "-" "-" 220.127.116.11 - - [02/Sep/2014:18:36:33 +0200] "POST /wp-login.php HTTP/1.0" 302 0 "-" "-" 18.104.22.168 - - [02/Sep/2014:18:36:34 +0200] "POST /wp-login.php HTTP/1.0" 302 0 "-" "-"
These kind of requests uses significant resources on my server, and the PHP process is constantly using CPU cycles.
I’ve tried manually banning the IP address, but I had no luck. I’ve tried using the
ngx_http_limit_req_module, but again no luck. I’ve found a tutorial on how to set-up a fail2ban filter to catch these kind of reqeusts from the access logs, but again no luck.
Today this IP flooded me with over 50.000 reqs and I needed to shut down the server for half an hour so it can stop.
Is there any proper automatic way to set up so the server can detect and block IP adresses that flood the server with requests like these? I don’t want to use wordpress plugins or anything like that, since I have a couple of sites installed and I don’t want to install security plugins to each of them.
Here’s the fail2ban filter I have added:
[Definition] failregex = ^<HOST> .* "POST /wp-login.php ignoreregex =
And here’s the rule implemented in jail.local
[wp-auth] enabled = true filter = wp-auth action = iptables-multiport[name=NoAuthFailures, port="http,https"] maxretry = 2
But I had no luck with this.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.
Click below to sign up and get $200 of credit to try our products over 60 days!