1

When I receive a request from a web spammer, such as a GET /wp-login.php, I am thinking of replying with an error (404) and closing the HTTP connection immediately with this header:

Connection: close

Is that sensible? It seems to me that this way I am not unlikely to save a connection for a real user...

Improve this question
5
  • 1
    The thing is, spammers can come from almost any IP address at any time and issuing error 404 based on a record of old IP addresses you may have collected might hurt you because if later, authorized users end up with an IP address you have blocked, then you'll have frustrated users. If possible, change wp-login.php to another filename for wordpress login and if it still works, then you're golden. This is because hackers usually run software that scans the same set of files at random times
    – Mike -- No longer here
    Oct 27, 2015 at 21:32
  • I don't use wordpress so the login page does not exist on my website (so the 404 happens already). I did not mention blocking any IP address. What I'm wondering about is the Connection: close on such requests.
    – Alexis Wilke
    Oct 27, 2015 at 21:44
  • I get a ton of this stuff and actually track and catalog these things and have for 8 years. It is a harmless request and actually helps that it 404s. Unless you get a ton of this stuff, I would not go too far out of my way on this because the list of request profiles will never really end. One of the best things you can to is to use ModSecurity and take the worry off your mind.
    – closetnoc
    Oct 27, 2015 at 23:43
  • @closetnoc, well... about 100 in 5 months for just "wp-login", if you look at the logs, similar things happen all day long... it surely decreases our CPU resources to let these go to the application. So yes, something somewhat similar to ModSecurity to block those early will help us a lot.
    – Alexis Wilke
    Oct 27, 2015 at 23:58
  • I can get thousands or 10's of thousands in any given day... but I bait them too. Silly wabbit!! Resources are not such a big deal, but running a site, I would want to block them too. I started tracking them 8+ years ago because I was getting p1$$3d too. In fact, I call it the pr*ck list. ;-) There are other tools, but I suspect that ModSecurity is the best and most mature. I am surprised that people do not use these tools more. I can also use my firewall's HTTP filters, but not everyone has that option available. I am thinking of using ModSecurity to replace my trap application soon.
    – closetnoc
    Oct 28, 2015 at 0:44

2 Answers 2

Reset to default
2

I'd recommend:

connection: close

on pages that don't list any other resources that are stored on your server for best performance.

If you can setup a 404 error page without loading any images or special assets, then connection: close is good.

If you need resources to completely load the error page, then connection: close isn't as good since the connection will be closed and another one will be made to load the assets. The closing and opening of a connection increases the time for all resources to be loaded.

This kind of page works with connection: close since no other server resources are required for the page to completely load:

<html>
<head>
<title>Not found</title>
</head>
<body>
Document is not found
</body>
</html>

This one uses resources from the local server, so I wouldn't recommend connection: close on it.

<html>
<head>
<title>Not found</title>
</head>
<body>
<img src="http://www.your-url.com/notfound.jpg">
Document is not found
</body>
</html>
Improve this answer
1
  • Ah! Yes, good point about the necessity of additional resources. In this case I use the former type of reply, absolutely no additional resources. For regular users I have more in the errors such as the favicon.ico.
    – Alexis Wilke
    Oct 27, 2015 at 23:53
0

You could just change the default WP admin URL

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.