3

I'm facing a weird situation where my 10 WordPress websites are getting hits for non-existent pages. Mostly those pages which we never created or had in our websites. I searched about it and found Non-existent child page URLs redirects to the image attachment URL instead of throwing 404 post.

This is something I also saw on my GA. But the difference here is that. I have links being directed without the domain name for example if my site name is example.com then I'm getting links like example.com/i-am-not-an-actual-page-post. There is no domain name associated with any of that referral spam traffic. But as the traffic increases it kills my VPS and put us in a drastic situation. This is happening with all of our sites. The IP's of each request is also completely random as I see in GA too. And as I told there is no domain with any request. Just mymainwebsite.com/non-existent-page-requested/ or example.com/the-eyes-ccdvxis/check-recipient-crossword-clue-2d0c09&from=https://www.google.com/ Links like these.

Has any one else experienced anything like this?

2
  • This may be automated bots looking for signs that your sites have been successfully hacked – John Conde Jan 6 at 18:48
  • @johnconde I think your edit is inappropriate as it makes this into a non-question (indeed I was scratching my head as to what the question was until I looked at it pre your edit) – davidgo Jan 6 at 20:04
1

To answer the question "how to block this" - there is no single correct answer, but a couple of thoughts -

  1. Move the site behind cloudflare or cloudfont or similar - they provide DoS protection and it is likely this will greatly mitigate your problem.

  2. Implement fail2ban or similar. Although there are a number of IP addresses, the supply used will not be infinite and carefully crafted custom rules will, over a little while be able to discern and block the affected sites. The difficulty will likely be in crafting suitable custom rules - how you do this would depend on characteristics of the site and logging not advised - eg looking for 404 errors, referee strings etc.

  3. Tune the site / cache it / make it static with a very lightweight 404 error (assuming its 404'ing)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.