1

Hi has anyone come across this before. It seems like a hack attempt on the site from a bot trying to access it as a wordpress site. This is obviously causing loads of errors in the log files bloating them and making it hard to find any real logs. Is there anything we can do in craft or on the server to block these attempts?

  • 1
    Note: this is no long term solution but for a quick fix: create the file, so those requests are not routed over Craft. Some people let the visitor download large files so the requests will end sooner or later but I would suggest to just die() it out. – Robin Schambach Jul 7 '18 at 9:38
  • Cheers Robin good tip. – Lettie Jul 7 '18 at 9:55
  • 2
    I like to set up a redirect in that file that sends them to wordpress.org/wp-login – foamcow Jul 7 '18 at 9:56
3

So what I do is I just redirect anything requesting a WordPress-ish thing to WordPress.com (that's what they are looking for, after all...). You can see how to do that here if you're using Nginx:

https://github.com/nystudio107/nginx-craft/blob/master/sites-available/somedomain.com.conf#L67

1

We've done the redirect route in Andrew's answer before and while it keeps some script kiddies out, it can also cause less "savvy" ones to think you actually have a valid WP installation and continue to hit you as well, which doesn't really solve the issue.

nginx is so efficient that we were using a few MBps in our outgoing bandwidth just to redirect a couple offenders before I realized what was hitting our server so hard.

The best option is to:

  1. Detect the attempt / 404 it
  2. Block it at the firewall level after they don't get the hint.

While we use nginx, you can also do some of this on apache. Use:

  • Rate limiting. Excessive bots will get detected pretty quickly here.
  • Use fail2ban to subsequently block those repeated attempts.
  • When you create a location block in nginx, just tell it to log this sort of junk in another file. Then point fail2ban at that log file. This approach works great especially if you have multiple virtual hosts.

Going down the rabbit hole even more, ModSecurity is a super complex beast and not for the faint of heart, but it's common among the big hosting providers to help keep the "riff raff" out.

CloudFlare, StackPath and Inscapsula can also help in this aspect with their web application firewalls if you're willing to let them handle your DNS. These services handle the request before it even gets to your server.

  • 1
    Yeah for sure, if there is massive traffic, blackhole'ing them is a good idea. For one client, we blackhole'd all of Russia (they had zero customers from there, and tons of bots/spammers) – andrew.welch Jul 9 '18 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.