2

Our website is being flooded with thousands of page requests. The access logs looks like this:

**.**.250.*9 - - [24/Oct/2017:09:16:32 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:32 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:33 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:33 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:33 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:34 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:34 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
**.**.250.*9 - - [24/Oct/2017:09:16:34 -0400] "GET /about-our-company/?screw-you HTTP/1.0" 200 14959 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"

Other than blocking the IPs manually what can we do to stop these attacks?

3

First of all, report whoever is doing it.

You obviously could block anything with a query-string that contains screw-you, but that'll only help in this case.

Maybe Drop any requests with HTTP/1.0 (browser don't use it, and "good" bots like google don't either, but if you need to provide access to special tools, you might not want to do this), but you should keep a close watch over what requests get dropped by this to make sure that you don't lose any legitimate traffic.

And of course, there are technical solutions that try to automatically discover this kind of traffic and block it. Have a look at CloudFlare, Incapsula, StackPath etc.

3

From WordPress point of view the most vulnerable part is resource–intensive loading of WordPress core and page generation.

So for a primitive attack your priority is to never let these reach WP core. That would mean intercepting them at some stage before at web server, reverse proxy, or firewall level. Depends on server stack and configuration options available to you.

If you use managed hosting contacting them is a good idea both for awareness and to hear their recommendations.

2

If you have access to the server you have some options like using mod_evasive (if using apache2) - this will throttle the requests.

It's also worth putting your website on some cache, like WP Super Cache, force preloading of caching and let it serve static files, it will reduce the chances of you bottlenecking.

Not the answer you're looking for? Browse other questions tagged or ask your own question.