Ask HN: A decentralised way to fight DDoS attacks?

Hi HN,

A simple Wordpress website and server I manage has been suffering a DDOS recently, and my attempts to combat it via fail2ban failed, so I've ended up using Cloudflare. Putting a huge centralised service in between the website and its readers feels like a privacy failure to me.

It's a simple website hosted on a physical server. The DDOS attack is trying to brute force /xmlrpc.php and /wp-login.php, so I'd blocked all access to xmlrpc.php in nginx, jailed any ips who requested it in fail2ban, and rate limited access to /wp-login.php. But still endless requests to both are being made at numerous times a second from an endless series of ips, crashing the server on a daily basis. Now I've got Cloudflare in the way I'm hoping to turn away to buggers before they reach the server. But is there no decentralised alternative?

This is par for the course. All domains get bots trying to brute force. It just means your site is more popular than the average.

Really, xmlrpc.php and wp-login.php should not be accessible at all. You can rename wp-login.php, or you can make it available to specific IP address(es), or you can ssh -L to access it via ssh.

It might be helpful to do a histogram of the IPs that try to access those files and sort it so you can see if many attempts are coming from IPs on the same networks. If so, you can report the most egregious ones to their ISPs, and/or you can outright block whole networks.

I've done this with large parts of HiNet in China because they allow any kind of abuse and don't take any actions whatsoever. It has cut my logs significantly.

It's a pretty low spec server tbh. Only 1gb ram, but that's plenty for regular usage. Assuming the botnet will just pump requests until all our memory's used up, so not much point upgrading, but maybe we should give it a try.

I've never personally seen a server with more than 512M RAM have issues running WordPress

Do you have swap setup?

Any weird PHP settings?