0

To start with, I don't know anything about coding and stuff. I am here to seek help from experts hoping they can help me resolve the issue.

I have a website/blog that runs on WordPress.

I have a VPS Server on which the website/blog runs. 2GB RAM, 2GB VSWAP, 80GB Storage and 1000 TB Bandwidth

Here is the problem:

At least once a day, my server goes on override with 100% RAM and VSWAP usage.

I tried to investigate the issue through cPanel (AwStat) and found something really perplexing.

"Unknown robot (identified by 'bot' followed by a space or one of the following characters _+:,.;/-) (HITS: 10,642+270) (Bandwidth: 820.94 MB) (Visit time: 10 Mar 2018 - 07:14)".

Upon further drilling down, I found something totally unbelievable! All these hits came from my own server IP.

Next I went on to see visitors' log on cPanel and found this:

"THEY WERE ALL ORIGINATING FROM MY WP-CONTENT FOLDER OR WAS A DIRECT URL OF MY WEBSITE."

I am totally stumped! What is causing these unusual hits from my own server from within my own website?

Can anyone help me to understand so that I can eliminate the issue?

My website/blog: https://factslegend.org

  • What is the URL of the originating 'bot'? That should be logged too. Maybe it is some plugin, but without knowing the URL from the log, I can't suggest anything. – Milan Petrovic Mar 10 '18 at 18:28
  • The URL is mostly my own website url: Self-referral. One of the referrals is: factslegend.org/20-interesting-kongka-la-pass-ufo-base-facts. There are many such referrals, which are basically links to my own content. – user2513375 Mar 10 '18 at 18:41
  • id recommend a security plugin scan. lots of free ones. sucuri, wordfence etc. if there's some malicious files... they may find it. – Joel M Mar 10 '18 at 19:14
  • you also said wp content dir, please post urk inside wp content. lots of ppl here could help you identify pretty easily based on url. ie. if it's an unknown php file in a directory where there shouldn't be php files then that's almost certainly a backdoor. some plugins do put some php in wp- content (well all of them.. but in /wp-cintent/ plugins) – Joel M Mar 10 '18 at 19:19
  • After hours of digging into statistics through cPanel, I have found that my server is getting clogged by traffic referred from my own site. I mean, self-referral traffic. It can be just any random post link from my website that sends traffic to various other urls of my website. For instance, IP: My server IP Visited URL: /wp-content/plugins/wc-shortcodes/public/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 Date: 3/12/18, Time: 2:18 AM Size: 0 Status: 304 Method: GET Protocol: HTTP/1.1 Referring URL: factslegend.org/30-yellow-sea-facts-need-project – user2513375 Mar 12 '18 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.