How do I protect my site from DDoS attacks?

[agatharose8]

What is the name of the domain?

Oracle Cards Online - Destiny

What is the error message?

DDoS attack in site

What is the issue you’re encountering

How do I protect my site from DDoS attacks?

What steps have you taken to resolve the issue?

Hi,

New WordPress user here. I’m concerned about DDoS attacks on my site. Currently using:

Free Cloudflare plan
Basic WordPress security plugin
Default settings
What settings should I enable in Cloudflare for better DDoS protection?

Thanks!

Was the site working with SSL prior to adding it to Cloudflare?

No

What is the current SSL/TLS setting?

Off

[GeorgeAppiah]

@agatharose8

How do I protect my site from DDoS attacks?

@agatharose8

I’m concerned about DDoS attacks on my site.

Here’s a learning path covering basic concepts and Cloudflare services to enable/configure to protect your domain and server from DDoS attacks.

Prevent DDoS attacks · Cloudflare Learning Paths

[fritex]

@agatharose8

What settings should I enable in Cloudflare for better DDoS protection?

Helpful articles:

Huge performance issues despite DDoS mode + rate limit

Set some firewall on the host origin like UFW and allow only yourself temporary. Lock your host and allow only Cloudflare IPs to connect: Make use of the Cache if possible on the host, or configure it at Cloudflare: I guess, if not some malicious or nulled theme if you’re using WordPress, you’d have to track & trace a bit those requests using Security → Analytics & Security → Events from the Cloudflare dashboard. You can temporary override your DDoS and set to “Block” action and sensi…

Useful post:

Cant allowlist my IP in WAF

Which part exactly? Are you getting blocked or? Have you tried splitting it into smaller chunks and testing what you want to achieve? Allow only your IP, onto what request, which, and where for the path or multiple files? Are you able to filter out all countries except your own for wp-login and then JS Challenge even your country after all the others are blocked? Cloudflare Access fits your needs if only you or a few members need access to WP login area: Or it’s about public forum or boa…

More cool stuff for WordPress security with Cloudflare:

What Request to Block in Firewall for Wordpress and Normalize URLs

That is a good question out there. I would say it cannot be stated as a general rule of thumb, as far as some WordPress websites do not have to use like POST or PUT (WP REST API, wp-json, plugins etc.), while other have to - just an example. You could try to block TRACE & TRACK for example. Or, if you could for example, limit HEAD, GET and POST for some specific IP or some similar scenario, where you protect your Website from bad bots, possible attacks, etc. in terms of security measurements. …

Cloudflare Access fits your needs if only you or a few members need access to WP login area:

Protect Your WordPress Login pages with Cloudflare Zero Trust

Manual DDoS mitigation:

Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Realizing how powerful and valuable Cloudflare Firewall Rules are. I initially thought of making a more complex guide (I will). However, I realized that no…