Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
|
litespeed_wiki:config:xmlrpc.php_bot_attack_block [2018/10/05 15:58] Jackson Zhang |
litespeed_wiki:config:xmlrpc.php_bot_attack_block [2018/10/05 18:52] (current) Lisa Clarke Proofreading |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== How to Block Bot Attack? ====== | + | ====== How to Block a Bot Attack ====== |
| - | Your server may experience heavy hits from bots. There are different ways to block bot attack. | + | Your server may experience heavy hits from bots. Here are three different examples of bot attacks and how to block them. |
| ===== Example 1: "BUbiNG" bot ===== | ===== Example 1: "BUbiNG" bot ===== | ||
| - | "BUbiNG" bot [[http://law.di.unimi.it/BUbiNG.html#wc|BUbiNG]] may have caused a massive load spike in the server. To prevent further problems, we can deny that user agent globally. | + | "BUbiNG" bot [[http://law.di.unimi.it/BUbiNG.html#wc|BUbiNG]] can cause a massive load spike in the server. To prevent further problems, we can deny that user agent globally. |
| An easy solution is to use a rewrite rule to detect the user agent, and then set environment with the action ''[E=blockbot]''. This will drop the direct connection from that client IP. | An easy solution is to use a rewrite rule to detect the user agent, and then set environment with the action ''[E=blockbot]''. This will drop the direct connection from that client IP. | ||
| - | Add the following to the ''.htaccess'' of the ''test.com'' domain: | + | Add the following to the ''.htaccess'' of your ''example.com'' domain: |
| RewriteEngine On | RewriteEngine On | ||
| Line 15: | Line 15: | ||
| To verify, you can run: | To verify, you can run: | ||
| - | curl -A "BUbiNG" test.com | + | curl -A "BUbiNG" example.com |
| - | If your rules need further debugging, you can enable rewrite log to check. | + | If your rules need further debugging, you can enable the rewrite log for more details. |
| - | ===== Example 2: Block xmlrpc.php Bot Attack ===== | + | ===== Example 2: "xmlrpc.php" Bot ===== |
| On a server, after configuring cPanel Piped Logging to push entries to ''/usr/local/apache/logs/error_log'', you can see many ''404 File not found [/var/www/html/xmlrpc.php]'' entries coming through. 404 will not trigger the LSWS WordPress protection feature, because the requests look like they're being processed by the default vhost. | On a server, after configuring cPanel Piped Logging to push entries to ''/usr/local/apache/logs/error_log'', you can see many ''404 File not found [/var/www/html/xmlrpc.php]'' entries coming through. 404 will not trigger the LSWS WordPress protection feature, because the requests look like they're being processed by the default vhost. | ||
| Line 29: | Line 29: | ||
| - | ===== Example 3: Block some cookies ===== | + | ===== Example 3: Cookie Bots ===== |
| If the bots are cookie related, you can also try something like the following and tailor it to what you need. | If the bots are cookie related, you can also try something like the following and tailor it to what you need. | ||
| - | RewriteCond %{HTTP_COOKIE} yourcookiename | + | RewriteCond %{HTTP_COOKIE} yourcookiename |
| - | RewriteRule .* - [F] | + | RewriteRule .* - [F] |