Practice
I use on some of our projects a very convenient site protector against attacker requests, unauthorized parsing, and non-distributed HTTP DDoS attacks, which I built over several years of working on other projects — flexible and fast. The class-script is written with minimal dependency on other modules, is simple to connect, requires no installation, and has flexible configuration. The essence of the protector's operation: each IP is checked (with caching) against several reliable sources in turn (for reliability). Reliability can also be determined by other criteria. There is a list (automatically expanding) of white and black IPs (v6 or v4).
The IPs of some search engines are automatically added to the whitelist, and IPs are automatically added to the blacklist when certain rule-conditions are met: number of requests per day, per hour, total number of requests, requests to a specific URL, requests with specific parameters, GET POST HEAD etc., cookies, HTTPS protocol, and so on. After installation, the daily server load decreased by more than 10-20% — it turned out that more than 50 useless search bots were indexing the site despite being disallowed in the robots file. Attempts to parse the sites are also successfully repelled. At the same time, almost all regular users retain access to the sites. The final decision to block an IP can be made instantly by following the corresponding links sent to email. It also renders an overall picture of suspicious requests to the site.
Comments