bot attack

wcors-com

One of my websites has been under a bot attack since last night. I’m currently unable to access the site because it is receiving a very high number of HTTP requests, (which I can clearly see in HTOP). causing 503 Service Unavailable error. I am already using cPFence with all the recommended security features enabled, but unfortunately, it has not been able to detect or mitigate this attack properly. (Using cPfence) At the moment, I feel helpless. Is there a tool that can help that can help fight the bot without involving cloudflare for a while?

cPFence

wcors-com

You can activate under attack mode in cPFence, more info :
https://community.cpfence.app/d/10-surviving-ddos-syn-flood-a-step-by-step-defense-guide

If you don’t want to use Cloudflare, which is honestly the best option for this kind of issue, you can still use several cPFence protections like country blocking, ASN blocking, and user-agent blocking.

You can also enable CAPTCHA in OpenLiteSpeed:
https://docs.openlitespeed.org/security/recaptcha/

wcors-com

cPFence so far why didn't cpfence yet not included features of rate limiting per domain name?

cPFence

wcors-com

Rate-limiting features belong at the proxy server or web server level. Implementing them in a security WAF product can cause significant overhead on server resources and is not recommended by the ModSecurity team. That’s why it is not available in all security products.

unlip

cPFence

I think it's worthwhile to create a testing system to combat this type of bot.

Despite Cloudflare, many attacks of this type end up getting through.

One of your competitors has a limiting option. I even tested this function on a test server and it didn't significantly overload the server. In fact, it even relieved the load.

It would be interesting to set something up and run a test to see if it would be beneficial.

cPFence

unlip

As I mentioned in the ticket before, as far as we know, no other security product currently offers true server-level rate limiting. cPGuard briefly introduced SYN flood protection in its firewall, but it was later removed in version 5.70 due to issues.

If you're referring to another product or feature, I'm happy to take a look.

Also, don't confuse http rate limiting with brute-force protection or log monitoring. cPFence has had those features for over a year. It continuously monitors logs and automatically blocks attacking IPs, so there is no need to run Fail2ban alongside cPFence, as the same functionality is already built in.