2

I use a DigitalOcean Ubuntu 16.04 machine with Bash, LEMP and WordPress.

I already did the best I can to protect the system and WordPress from BFAs and Backdoors, and to protect WordPress from DB injection by issuing only one simple contact form and automatic updates from the WP-CLI.

In all humbleness, it's unlikely that I'll be attacked in DDoS, but I do have a small fear of a single machine DoS (SMDoS) attack as many data requests from one machine.

The fear of an SMDoS woke up in my mind after thinking that I cannot know if someday I'll have a clash with some unstable person which happens to know Linux cracking well enough and will try to destroy a site / server environment I have I have as a revenge.

Gladly I didn't have to cope with such case but I do want to prepare myself for such unlikely case. SMDoS is indeed something just one human can do.

I don't know what's needed for the attacker to do that in the network level but in the web (application) layer I think nothing more is needed than some JavaScript.

  • Hmm so one last question please @schroeder - why all these plugins don't defend from DDoS but does defend from a single-machine ALDoS? – user9303970 Apr 26 '18 at 13:03
  • 1
    It's because is very easy to throttle one single IP, or block it altogether. Blocking a large number of unrelated IPs is hard, blocking a single one is trivial. – ThoriumBR Apr 26 '18 at 13:05
  • 1
    Because DDoS is not an application level problem - it's network level problem. You can also throttle a single IP's traffic at the network level, but you do not have access to the network on DO, so you're left with application-level options. The closer to the attacker you can get, the better options you have to stop the traffic. – schroeder Apr 26 '18 at 13:05
1

A good defense against DDoS attacks (and smaller DOS attacks) is using cloudflare. They have a free tier for websites that offers an "I'm under attack!" mode. Read more about it Here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.