Hi has anyone come across this before. It seems like a hack attempt on the site from a bot trying to access it as a wordpress site. This is obviously causing loads of errors in the log files bloating them and making it hard to find any real logs. Is there anything we can do in craft or on the server to block these attempts?
So what I do is I just redirect anything requesting a WordPress-ish thing to WordPress.com (that's what they are looking for, after all...). You can see how to do that here if you're using Nginx:
We've done the redirect route in Andrew's answer before and while it keeps some script kiddies out, it can also cause less "savvy" ones to think you actually have a valid WP installation and continue to hit you as well, which doesn't really solve the issue.
nginx is so efficient that we were using a few MBps in our outgoing bandwidth just to redirect a couple offenders before I realized what was hitting our server so hard.
The best option is to:
- Detect the attempt / 404 it
- Block it at the firewall level after they don't get the hint.
While we use nginx, you can also do some of this on apache. Use:
- Rate limiting. Excessive bots will get detected pretty quickly here.
- Use fail2ban to subsequently block those repeated attempts.
- When you create a
locationblock in nginx, just tell it to log this sort of junk in another file. Then point fail2ban at that log file. This approach works great especially if you have multiple virtual hosts.
Going down the rabbit hole even more, ModSecurity is a super complex beast and not for the faint of heart, but it's common among the big hosting providers to help keep the "riff raff" out.
CloudFlare, StackPath and Inscapsula can also help in this aspect with their web application firewalls if you're willing to let them handle your DNS. These services handle the request before it even gets to your server.