I had some kind of attack on my server but from millions of random IPs so I couldn’t effectively block them.
I then had the idea to rate limit access to wp-login.php to say 2 accesses per minute as most sites have very few users so this should be the easiest way but I’m not sure if this is a good solution?
If you think its good, here is what I tried but failed with error:
19.10.2015-15:31 - WARNING - Reason for nginx restart failure: Restarting nginx: nginx failed! nginx: [emerg] unknown limit_req_zone “one” in /etc/nginx/sites-enabled/100-israelsafety.com.vhost:192 nginx: configuration file /etc/nginx/nginx.conf test failed
inside nginx.conf:
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/m;
its very low at 1r/1m for testing purposes
inside vhost.conf: location ~ /wp-login(/.php) { try_files $uri =404; include /etc/nginx/fastcgi_params; fastcgi_pass unix:/var/lib/php5-fpm/web1.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_intercept_errors on; fastcgi_buffer_size 128k; fastcgi_buffers 256 16k; fastcgi_busy_buffers_size 256k; fastcgi_temp_file_write_size 256k; fastcgi_read_timeout 3000; fastcgi_cache_bypass $skip_cache; fastcgi_no_cache $skip_cache; fastcgi_cache WORDPRESS; fastcgi_cache_valid 60m; limit_req zone=one burst=5; }
Anyone see any errors here? Is this line correct: limit_req zone=one burst=5; ?
