Wordpress Websites Getting High Traffic for the non-Existent Pages like a DDOS Attack

Question

I'm facing a weird situation where my 10 WordPress websites are getting hits for non-existent pages. Mostly those pages which we never created or had in our websites. I searched about it and found Non-existent child page URLs redirects to the image attachment URL instead of throwing 404 post.

This is something I also saw on my GA. But the difference here is that. I have links being directed without the domain name for example if my site name is example.com then I'm getting links like example.com/i-am-not-an-actual-page-post. There is no domain name associated with any of that referral spam traffic. But as the traffic increases it kills my VPS and put us in a drastic situation. This is happening with all of our sites. The IP's of each request is also completely random as I see in GA too. And as I told there is no domain with any request. Just mymainwebsite.com/non-existent-page-requested/ or example.com/the-eyes-ccdvxis/check-recipient-crossword-clue-2d0c09&from=https://www.google.com/ Links like these.

Has any one else experienced anything like this?

Answer 1

To answer the question "how to block this" - there is no single correct answer, but a couple of thoughts -

1. Move the site behind cloudflare or cloudfont or similar - they provide DoS protection and it is likely this will greatly mitigate your problem.

2. Implement fail2ban or similar. Although there are a number of IP addresses, the supply used will not be infinite and carefully crafted custom rules will, over a little while be able to discern and block the affected sites. The difficulty will likely be in crafting suitable custom rules - how you do this would depend on characteristics of the site and logging not advised - eg looking for 404 errors, referee strings etc.

3. Tune the site / cache it / make it static with a very lightweight 404 error (assuming its 404'ing)