Settings close to under attack mode

[dovzhenkoevgeniy]

Hello
Site is on Wordpress
Its under ddos attack right now
When “Under atack mode” is active I have NO problems with server load, so its working fine.
But some features like crossposting to social and scheduled posts are not working.

I know from which country attack is going

If I disable “Under attack” mode and make rule (country equals to “attacking country” to block that country, i have problems with server load. Like its not blocking anything

Can i make something like Under attack mode ? ,But not so strict, that my scheduled posts and crossposting plugins could work properly (because when under attack mode is active I have errors in wp site health - REST api error, and site could not complete loopback request)

[ndbiaw]

You should check and make the URLs list that you will need to use and create FireWall’s rules that bypass UAM with your IP.
For example, the post scheduling feature, it is possible that your server itself is blocked when trying to access the website through Cloudflare.

[fritex]

@dovzhenkoevgeniy

because when under attack mode is active

Shouldn’t be active all the time. Set it at least to Medium.

I’d suggest and sharing my useful post about WordPress security, if that’s a concern:

What Request to Block in Firewall for Wordpress and Normalize URLs

That is a good question out there. I would say it cannot be stated as a general rule of thumb, as far as some WordPress websites do not have to use like POST or PUT (WP REST API, wp-json, plugins etc.), while other have to - just an example. You could try to block TRACE & TRACK for example. Or, if you could for example, limit HEAD, GET and POST for some specific IP or some similar scenario, where you protect your Website from bad bots, possible attacks, etc. in terms of security measurements. …

@dovzhenkoevgeniy

When “Under atack mode” is active I have NO problems with server load, so its working fine.

I am afraid you should look for better web hosting provider, or at least troubleshoot your theme and plugins:

Debugging in WordPress

Therefore, tune-up your PHP values a bit at your server/hosting provider/cPanel if you can:

memory_limit = 256M
max_execution_time = 300
max_input_time = 1000
max_input_vars = 5000 or 7000
post_max_size = 64M
upload_max_filesize = 32M

You should install some of the WordPress caching plugin for cache like WP Super Cache:

WP Super Cache

Make sure Cloudflare is proxied and set to for your website (both www and non-www).

Regarding performance, you can try out Cloudflare APO for WordPress for a month and see how it goes:

How to Set up Cloudflare APO for WordPress – A Deep Dive into Boosting Performance up to 300%

This article from Kinsta shows how Cloudflare APO works and how you can use it to boost the performance of your WordPress site. Table of Contents What Is Automatic Platform Optimization (APO)? Static HTML at the Edge The State of Web Performance In 2020 How Cloudflare’s Automatic Platform Optimization Works Maximize WordPress Performance with High-Performance Hosting and Cloudflare APO How to Use Cloudflare Automatic Platform Optimization for WordPress How to Confirm Cloudflare APO for WordPr…

Some useful multiple stuff linked inline here:

Best Way to Cache Ecwid.com Ecommerce Store

Despite of not knowing the capabilities of the origin host/server of ecwid provider, in terms of a W3TC, and despite this might be a question for StackExchange forums, but from my experience with, you would have to make sure and enable: configure web server (Apache or Nginx or some other) → PHP tuning + PHP-OPCache (Zend) Page Cache: Disk Browser cache (configure per need) Database cache: Memcached Object cache: Redis exclude cookie cache and pages like cart/account/checkout at W3TC due to the…

WooCommerce Website

I would like to add a note from my experience. Mostly, it depends on the origin host / server which needs to be optimized and tuned up. The best case scenario which I have tested and is working perfectly fine (for my case) was the combination of: dedicated server (1Gbps link, NvME disks, good CPU and enough RAM) WP + WC (updated) Nginx (with open file cache configured) W3 Total Cache (PHP OPCache, Memcached, Redis, Page Cache, Browser Cache) Cloudflare (Free or Pro plan) Great one. I wa…

@dovzhenkoevgeniy

But some features like crossposting to social and scheduled posts are not working.

@dovzhenkoevgeniy

I have errors in wp site health - REST api error

In that case, I’d suggest you to whiltelist/allow your server IP by navigating to the Security → Tools → IP Access Rules. Add your origin host / server / web hosting IP address in the input field and select the action “allow” from the dropdown for your website.

Furthermore, are you using any of the WordPress security plugins which could restrict WP JSON or it’s API, so maybe some of your plugin(s) might not work as expected?

@dovzhenkoevgeniy

make rule (country equals to “attacking country” to block that country, i have problems with server load. Like its not blocking anything

Can you share a screenshot of this Firewall rule?