DN&P Here's a guide on how to safeguard your website against DDoS attacks without any cost!

[Excunian]

Hello everyone! In this post, I'll be demonstrating how to safeguard your website from DDoS attacks at no cost, and it's straightforward to set up.

Here are the things you'll need: your website is linked to Cloudflare CDN (https://support.cloudflare.com/hc/e...ing-a-Cloudflare-account-and-adding-a-website), and your website could be either WordPress-based or not.

Once you navigate to your website's overview:



Let's begin by visiting the Firewall section, which can be found on the left-hand side of the menu, and then clicking on Firewall Rules.




Here, you'll need to generate a few Firewall Rules by selecting "Create a Firewall rule." The initial rule we'll create is exclusively for WordPress-based websites and won't be beneficial if your website isn't using WordPress.



Upon visiting the "Create Firewall rule" section, you can name it anything you prefer since the name isn't critical. After that, select "Use expression builder" and paste the following code:


(http.request.uri.path contains "/admin-ajax.php") or (http.request.uri.path contains "/wp-admin") or (http.request.uri.path contains "/wp-cron.php") or (http.request.uri.path contains "/wp-config.php") or (http.request.uri.path contains "/xmlrpc.php") or (http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/favicon.ico") or (http.request.uri.path contains "/wp-load.php") or (http.request.uri.path contains "/wp-includes") or (http.request.uri.path contains "/wp-json") or (http.request.uri.path contains "/?wp_service_worker=1")

(http.user_agent contains "Yandex") or (http.user_agent contains "muckrack") or (http.user_agent contains "Qwantify") or (http.user_agent contains "Sogou") or (http.user_agent contains "BUbiNG") or (http.user_agent contains "knowledge") or (http.user_agent contains "CFNetwork") or (http.user_agent contains "Scrapy") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "AhrefsBot") or (http.user_agent contains "Baiduspider") or (http.user_agent contains "python-requests") or (http.user_agent contains "crawl" and not cf.client.bot) or (http.user_agent contains "Crawl" and not cf.client.bot) or (http.user_agent contains "bot" and not http.user_agent contains "bingbot" and not http.user_agent contains "Google" and not http.user_agent contains "Twitter" and not cf.client.bot) or (http.user_agent contains "Bot" and not http.user_agent contains "Google" and not cf.client.bot) or (http.user_agent contains "Spider" and not cf.client.bot) or (http.user_agent contains "spider" and not cf.client.bot)


Then, select "Block" as the action.

These two rules will offer robust protection for your website. As for the third rule, it will safeguard you from spammers and provide some DDoS filtering.



If an person's threat score surpasses 5, they should be given the Legacy Captcha. If none of the aforementioned methods have proven useful in combating the ongoing DDoS attack against your website, it's time to activate the "I'm under attack" mode.



On the right-hand side of the screen, you'll see "js," turn it on. Once the DDoS attack has subsided, don't forget to disable it and switch to "Hard."

If none of the previous measures prove effective, it's time to implement the OverKill rule (a somewhat cringy name I came up with for this rule). If your website has a global audience and isn't specific to a single country, you should opt for a rule that imposes "Legacy CAPTCHA" on all continents.



If you feel that the previous measure is too taxing, you may consider implementing Legacy CAPTCHA on all continents, excluding the United States, for example, if the majority of your traffic originates from the US. Additionally, you could create another rule for placing all other North American countries under the Challenge action.

However, if your website caters to specific countries, this rule will be more advantageous for you. You can place all unimportant continents under Legacy CAPTCHA in one rule and include other countries on your continent under Legacy CAPTCHA as well, as demonstrated here:



What should be the next step?



Navigate to the "Bots" section.



Navigate to the section labeled "Bots."



Activate the option. If you have followed all the aforementioned steps, you will have acquired some basic understanding of this topic, and you may also explore the "DDoS" tab in the menu.




That concludes the steps required to protect your website from DDoS attacks. If none of the aforementioned methods get positive results, it could indicate that your website isn't adequately optimized. Ensure that your website has a robust cache and optimization plugins. If many people request it, I will produce a guide on this topic in the future.

In conclusion, I hope you all have a wonderful day and excellent health. God bless you!

 

[Felineaudi]

One day recently, I experienced a sudden surge in traffic on one of my websites. However, I noticed that not only was this site inaccessible, but other websites hosted on the same shared server were also unreachable due to the server running out of memory. To address the issue, I promptly enabled the "Under Attack" mode, and within approximately two hours, the sites returned to normal.

Upon investigating the logs the following day, I discovered that what I initially assumed to be a DDoS attack was actually search engine bots, including ahrefs and SEMrush bots, crawling through thousands of pages on the site. It appears that enabling the challenges during the "Under Attack" mode can also block genuine bots. Is there a way to exclude these legitimate bots while still providing protection against malicious activity?

 

[Fishapis]

Thank you for your feedback! Regarding your question, the specific features and limitations of Cloudflare's free plan can vary, so it's best to consult their documentation or reach out to their support team for accurate information on whether the "Under Attack" mode is included in the free plan.

Additionally, you mentioned that OVH and possibly other providers offer free DDoS attack prevention. It's true that various hosting providers, including OVH, may provide built-in DDoS protection as part of their hosting packages. Other cloud providers like AWS and GCP also offer DDoS protection services, although they may have different pricing models or plans for these features. It's advisable to research and compare the offerings of different providers to find the most suitable DDoS protection solution for your needs.

 

[Fishar]

Cloudflare is widely regarded as one of the best options for free DDoS protection. Their services are highly regarded in terms of mitigating DDoS attacks without requiring additional charges, making them a popular choice for website owners seeking cost-effective protection against such threats.

 

[HellSuper]

Thanks for share!

 

[Inferner]

A DDoS (Distributed Denial of Service) attack is a malicious attempt to disrupt the normal functioning of a website, server, or network by overwhelming it with a flood of incoming traffic. In a DDoS attack, multiple compromised computers or devices, known as a botnet, are used to generate a massive volume of traffic, causing the target system to become overloaded and unavailable to legitimate users. The goal of a DDoS attack is to exhaust the target's resources, such as bandwidth, processing power, or memory, resulting in service disruption or downtime.

 

[InformerRappa]

A DDoS (Distributed Denial of Service) attack is a malicious attempt to disrupt the normal functioning of a website, server, or network by overwhelming it with a flood of incoming traffic. In a DDoS attack, multiple compromised computers or devices, known as a botnet, are used to generate a massive volume of traffic, causing the target system to become overloaded and unavailable to legitimate users. The goal of a DDoS attack is to exhaust the target's resources, such as bandwidth, processing power, or memory, resulting in service disruption or downtime.

When someone attempts to launch an attack on your website with the intention of causing it to crash or become inaccessible, you can search for more information about it on Google.

 

[Landia]

Thank you for your feedback on the previous post. I understand that bad bots are not recommended because they can prevent various search engines and API calls from accessing your website. This can be problematic, especially for production websites or SAAS (Software as a Service) platforms that rely on these channels to pull data via API. It's important to take measures to differentiate between malicious bots and legitimate search engines or API requests to ensure smooth operation and proper data retrieval for your website.

 

[LuvChamp]

It's important to note that while Cloudflare provides some level of protection against DDoS attacks, it may not be sufficient if your hosting provider lacks strong DDoS protection measures. It is crucial to ensure that your hosting provider offers robust DDoS protection to effectively safeguard your website.

While Cloudflare can offer assistance in mitigating DDoS attacks, it's true that there are ways for attackers to bypass its protection and potentially take down a website. It's recommended to have a reliable hosting provider with robust DDoS protection capabilities to enhance the overall security and resilience of your website. Cloudflare's services can be helpful to some extent, but they should not be solely relied upon for complete protection against all DDoS threats.

 

[Nsmilepera]

It's important to note that while Cloudflare provides some level of protection against DDoS attacks, it may not be sufficient if your hosting provider lacks strong DDoS protection measures. It is crucial to ensure that your hosting provider offers robust DDoS protection to effectively safeguard your website.

While Cloudflare can offer assistance in mitigating DDoS attacks, it's true that there are ways for attackers to bypass its protection and potentially take down a website. It's recommended to have a reliable hosting provider with robust DDoS protection capabilities to enhance the overall security and resilience of your website. Cloudflare's services can be helpful to some extent, but they should not be solely relied upon for complete protection against all DDoS threats.

You're correct. When everything is properly configured, it is generally not possible to determine the real server IP behind Cloudflare. This protection is achieved by ensuring that all aspects of the website, including email and subdomains, are properly proxied and their IP addresses are not exposed. The only potential vulnerability is if there are email or subdomains that are not properly proxied, which could leak the IP address. Another scenario where the server IP could be discovered is if it was logged or recorded prior to implementing Cloudflare's services. However, under normal circumstances, Cloudflare provides effective protection to shield the origin server's IP address.