Is your WordPress site under a “Pingback” DDoS attack? Use iptables

“Pingback” DDoS attacks on WordPress sites can generate large numbers of requests that can ultimately affect your website’s performance and availability. You can easily recognise these attacks in your logs: thousands of requests from “WordPress xxx” User-Agents sending you a “pingback”.
 
You can use an .htaccess rule to block the WordPress User-Agent, as shown at the end of this post. However, that will not stop your Apache, Nginx or other web server from becoming saturated if there are far too many connections. The solution is to use iptables directly to get rid of the requests before your favourite web server even processes them. Here is how I do it:

iptables -N Wpddosblock
iptables -I INPUT -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /' -j Wpddosblock
iptables -A Wpddosblock -p tcp --dport 80 -m string --to 80 --algo bm ! --string 'User-Agent: WordPress/' -j RETURN
iptables -A Wpddosblock -p tcp --dport 80 -m string --to 300 --algo bm --string 'verifying pingback from' -j DROP
iptables -A Wpddosblock -j RETURN

You can also download my shell script directly to do the work for you through this link: wpddosblock.sh

If you want to download it directly from the server currently under attack:

wget --no-check-certificate https://www.christophe-casalegno.com/tools/wpddosblock.sh
chmod +x wpddosblock.sh
./wpddosblock.sh

Be careful: if your site uses HTTPS, you will not be able to use iptables. You will then need to rely on the application layer and block the attack directly in your vhost configuration or your website’s .htaccess file, as follows:

Order Deny,Allow
SetEnvIf User-Agent WordPress keep_out
Deny from env=keep_out

or:

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} WordPress
RewriteRule .* - [F]

Christophe Casalegno
You can follow me on: Twitter | Facebook | Linkedin | Telegram | Youtube