As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections.
sudo add-apt-repository ppa:certbot/certbot -y && apt-get update -y && apt-get upgrade -y sudo apt-get install zip unzip tree unattended-upgrades sshguard postfix \ nginx python-certbot-nginx mysql-server php-fpm php-mysql php-mbstring php-mcrypt -y sudo ufw enable && ufw allow 22/tcp 25/tcp 80/tcp 443/tcp 9000/tcp
To prevent MITM attacks, generally all data transmission of all sites is via TLS, via a Let'sEncrypt SSL certificate (Green padlock in browser for all pages).
To prevent CMS DB injections I've enabled frequent updates via *nix cron (and kept forms minimal):
0 1 * * * for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp plugin update --all --allow-root; done 0 2 * * * for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp core update --allow-root; done 0 3 * * * for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp theme update --all --allow-root; done
But it seems I didn't do anything against DDoS. What can I do against someone who sends a robot to load my webpages about 50,000 times per hour (or something of that sort)?
Is there something that can be done directly form Ubuntu/Nginx/WordPress or by some Linux software?
AFAIK, BFA, DBI and DDoS are the 3 most common types of attacks DoS attacks (to be distinguished from MITM which isn't a DoS attack). Sorry if I missed anything.
I ran a search here in Information Security StackExchange with the phrase
Nginx Ubuntu DDOSbut didn't find a thread session this.