CSF port flood

[cwfie]

Hi All,

Recently I'm getting a lot of Wordpress "attacks".
The load is changing to +/- 29 (normally below 1)

Apache server status examples:

www.site.com:80 HEAD /sysadmin/fckeditor/editor/ HTTP/1.1
www.site.com:80 HEAD  /cms/wp-cron.php?doing_wp_cron=1422620840.8922209739685058
www.site.com:80 HEAD /editorold/editor/ HTTP/1.1
www.site.com:80 HEAD /inc/fckeditor/editor/ HTTP/1.1
www.site.com:80 HEAD  /cms/wp-content/themes/<theme>/framework/bootstrap/css/bo

etc. etc.

This has caused my MySQL to crash.

I'm using CSF as a firewall (works with DirectAdmin BFD).

I tried switching on portflood to prevent Wordpress attacks (click: http://download.configserver.com/csf/readme.txt)

PORTFLOOD = "80;tcp;20;5"

However I'm getting a lot of blocks (one every hour) and I'm affraid these blocks are legimate visitors.
CSF only allows a maximum of 20 packets per address remembered. So I cannot higher the number.

Does anyone have a similar problem? What are you doing to block these Wordpress attacks?

Thanks !

 

[zEitEr]

Hello,

Let Directadmin block IPs of attackers which try to bruteforce your WP sites.

related feature "Apache WordPress log scanning in BFM" since DA 1.47
http://directadmin.com/features.php?id=1695

p.s. BFM+CSF http://forum.directadmin.com/showthread.php?t=44839

 

[cwfie]

Hello,

Let Directadmin block IPs of attackers which try to bruteforce your WP sites.

related feature "Apache WordPress log scanning in BFM" since DA 1.47
http://directadmin.com/features.php?id=1695

p.s. BFM+CSF http://forum.directadmin.com/showthread.php?t=44839

Thanks, however this is not the case, they are not trying to bruteforce as the wp-login/wp-admin are not accessable. These are flood attacks.

Any other suggestions?

 

[SeLLeRoNe]

Install WP-Security in Wordpress and let it block users by .htaccess file It works pretty well.

Regards

 

[zEitEr]

Any other suggestions?

Yes, NGINX Module ngx_http_limit_conn_module http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html

 

[Petertjuh360]

Follow this Thread: http://forum.directadmin.com/showthread.php?p=171170