My problem is,
Once in two months, exactly at the time when Let's Encrypt update is running on the hosting, some kind of unknown attack is happen and the only thing I find after that is huge amount of errors (like thousands of errors, sometimes 40k or even 200k errors and more) on the chart indicator(red line) Resource usage monitor. Because of the nature of how cheap hosting companies work there is no logs that I can examine the incident and the only answer from the support team is something like "your code is bad" and when I ask to show me logs with those 40k errors then the answer is "see red line on the chart".
I have a Cloudflare WAF, but unfortunately that doesn't seem to help.
I have also checked my code and 99.999999999% sure my code is fine.
Is there something I can do about it? Because installing honeypot is not an option in case of cheap hosting. I mean, I know I can switch company and this is my current plan actually to buy a VPS.
Just for the record, this is my 3rd hosting, but 1st time facing those kind of problems, also 1st time I use Let's Encrypt preinstalled on that hosting.
EDIT Oct 02 2024:
As @LuisAlbertoBarandiaran proposed, I have disabled the Let's Encrypt certificate. The same attack occured but on a different time
This time I got the IP address of the attacker. It simply connects to every entry point on my website all at once with different user-agents. I have abuse cases archive, so I can see exactly datetime of each previous attack ever happened and also I have some apache logs from the hosting company that are not include all the errors on the chart, as I have described previously, but still can be helpful. I decided to go through all the logs from past incidents and what I found is that they don't store these logs, but they do store all the others. Let's say last year I accidentally organized an attack on myself and these logs are still there, while all the other logs related to the attacker incidents disappeared. I suspect the hosting company because they have an interest in selling me a more expensive package of services that they offer. If it is not the hosting company, then perhaps someone from the inside, because for such an attack you need to know the time when to attack and after I have disabled Let's Encrypt the attacker suddenly decided to try a more extensive attack on every single entry point which never happened this way before. Luckily this time my site continued to work and did not give a single 500 error, so I think everything worked out and I will wait to see what else he comes up with...
Anyway, it seems the problem is solved. Thank you, @LuisAlbertoBarandiaran, for the advice!
UPDATE ON THE ATTACKER: It turns out to be a known fraudster, some info found on the internet https://scamalytics.com/ip/isp/pptechnology-limited
