Hi @crazyhamster,
Thanks for reaching out.
In your access logs, a 503 is being returned. This is the Wordfence firewall at work blocking the attacker. When optimized, the Wordfence Firewall will significantly reduce the resources used by each blocked request made to your site.
However, as a web application firewall, while Wordfence can prevent access to the site content, it can’t prevent bad actors from accessing the server altogether. Consider implementing a firewall or DoS mitigation service before the server to prevent the attacker from hitting the server altogether.
Please let me know if you have any questions!
Thanks,
Margaret
Then what does the rule mean: blocking the IP for two hours (in my case), when trying to access the list of forbidden URLs? It’s supposed to work like a honey pot, doesn’t it?
So the plugin doesn’t have the capability to automatically add an IP to the blacklist in case of violation of the rules? Error 503 doesn’t solve the problem of attacks.
Hi @crazyhamster,
If you’re receiving true DDoS, or at the very least a huge increase in attempted page views, protection at the server’s end such as Cloudflare (as one example) should be the most effective solution. I say this because Wordfence is an endpoint firewall, so can catch/restrict/block users using Brute Force or Rate Limiting settings after PHP loads but, when optimized, before the point your site tries to host content to them. Restrictions therefore are possible, but it can’t stop the requests from initially hitting your site, even if it ends up blocking them.
Think of the visitor’s journey through various layers of protection. When they reach your server, they’ll first pass the server firewall, then they’ll access the web server, and then request a specific page. When they request the page, Wordfence will then be loaded, review the visit, and determine a response. In this case, it returns a 503 response (the Wordfence block page) to block the visitor. It’ll continue to return a 503 response every time it sees a visitor from the blocked IP until the block expires.
While Wordfence is effective at blocking unwanted visitors and preventing malicious activity on the site, it can’t prevent them from reaching the web server in the first place. Instead, it serves a block page that stops access to your content and unwanted actions. To block unwanted traffic at the outset, a server-side solution is essential, as it screens traffic before it reaches your web server.
Please let me know if you have any questions,
Margaret
