0

So my real problem is that today I've suddenly been having issues with entry processes and IOPS far exceeding the hosting account limits and causing my site to go down. I've never even gotten close to reaching these limits in the past, and nothing has changed. So this has lead me to review the Awstats to see if I can find out what's going on, and I've found some strange things.

I've found a few things that look abnormal, but the strangest thing is that under the "Locales" section it's showing 9,400 hits using only 8.4MB of bandwidth, and under the "Hosts" section, I've got one IP showing over 7,000 hits using only 23KB of bandwidth, and another with 1,300 hits using 0 bandwidth.

I don't know a ton about this stuff, but from what I've read this seems abnormal. I've been searching around to see if anyone else has experience hits without bandwidth and I can't find any information on that.

I am thinking that this might have something to do with the resource usage issues I'm having. I'm hoping someone here can shed some more light on this for me, as my searches have not brought me anything useful.

Thanks in advance!

  • Sounds like a bot attack. Cloudflare sent out notices today about widespread DDoS attacks across its network trying to solicit ransomware payments, demonstrating short lived DDoS attacks as proof that they'll occur. Try to add the IP's to a firewall rule, ModSecurity, or other similar blacklist. It might be a good idea to backup any sensitive data just in case. – dan Oct 17 at 5:02
  • 1
    Thanks for the info @dan! As I went to block the IP addresses, I realized that the IP responsible for the 7,000 hits (using only 23KB of bandwidth) is actually the shared IP address for the server. I feel so dumb for not seeing that sooner. But now I have no idea that means at this point? – JLW Oct 17 at 16:26
  • It's hard to tell, any account or application on the server could be using a socket to connect to your site and request small amounts of data. That might suggest malware, or it could be just an application or script that's misconfigured... If you can run top or ps you might be able to spot the process (see this). Otherwise I'd suggest contacting support for your shared hosting. They'll be able to see CPU spikes for all the processes on that server for all the other users. Good luck! – dan Oct 17 at 17:11
  • 1
    @dan, okay I will have to do some more digging to get to the bottom of it. Thank you for pointing me in the right direction! – JLW Oct 19 at 21:20
0

You need to set up a firewall in WordPress blocking some country's access to your site example china. I had that problem before. you will filter them by country.

| improve this answer | |
  • I don't think blocking countries is an option for me, because the problematic countries listed in the Awstats are countries that need to access my site. – JLW Oct 19 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.