I have wordpress site that is under some kind of bot attack. I checked apache logs and there's get request to a single post on my blog every second (sometimes there's more than one per second). When i block ip address of attacker in htaccess file, requests continue but it's one every 5-10 seconds. If i unblock it, after few minutes it get's back to 1 or more every second.

IP Address of attacker is changing once or twice every day.

I have wordfence plugin installed that blocks attacks, i also manualy add ip adresses to htaccess, but i'm interested if there's another way to block this guy for good...

He's always identified as blank user agent, always get same page and it's always only one single page request.

Here's part of apache log with attack. - - [20/May/2013:02:35:46 -0500] "GET /2012/01/19/skembici-u-saftu/ HTTP/1.1" 200 48097 "-" "-" - - [20/May/2013:02:35:55 -0500] "GET /2012/01/19/skembici-u-saftu/ HTTP/1.1" 200 47939 "-" "-" - - [20/May/2013:02:35:59 -0500] "GET /2012/01/19/skembici-u-saftu/ HTTP/1.1" 200 47970 "-" "-"
  • 1
    apps.db.ripe.net/search/… - is the whois for that IP. The abuse email address is on there if you wish to report the issue to the ISP May 20, 2013 at 12:17
  • Thanks Tim. I already know who's provider, i sent them several e-mails and call them few times, but people who work in tech support don't even know what i'm talking about and even less how to stop that... To be even worse, that's biggest internet provider in my country... May 20, 2013 at 14:55

1 Answer 1


Since the user agent is blank, you could use that to trigger a block:

RewriteEngine On  
SetEnvIfNoCase User-Agent "^-?$" bad_user
Deny from env=bad_user

I put in -? in case the user agent being sent is actually a dash. It is very hard to tell from your logs whether it is actually blank, or if it is a dash.

The linked resource on StackOverflow has examples of several other rules based on User-Agent and Referrer as well.

  • I added this code to my site and in next few days i'll see if this is final solution for my problem. May 20, 2013 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.