Blocking the Bad Guys and Bad Bots, Can It Be Done on The Cheap?

Posted on 02.25.24 | Jim Walker | 1 Comment

Within the WordPress community, I find a lot of folks use a variety of security plugins and methods to secure their websites against denial of service attacks and brute force connections.

Recently I’ve begun reading several comments in the Facebook forums and personal blogs regarding how poorly Cloudflare performs against automated website attacks.

I find this strange because Cloudflare has always promoted the benefits of its distributed content delivery network (CDN) to help reduce the impacts of extreme events, like mass IP connections, and it has protocols in place to help reduce Layer 7 DOS and brute-force attacks as well.

That said, it’s become apparent to me that many are simply not taking the next step in using Cloudflare to better protect websites against denial of service attacks (video), and implementing them appropriate to their needs.

I use the free Cloudflare service to help protect my website and I use my web host’s free SSL certificate to better secure my login page and forms. Using the free Cloudflare and SSL certificate services seems like a no-brainer to me.

So what about blocking the bad guys and bad bots you ask?

If you have Cloudflare set up already, then you are halfway there. A little-known feature of Cloudflare, called “Advanced Rate Limiting” allows you to create rules to block specific types and rates of traffic connecting to your website. Best of all, the Advanced Rate Limiting service is free (with some limits).

Check this article, Introducing Advanced Rate Limiting on the Cloudflare website for more details.

Quick start:
To get to the Advanced Rate Limiting feature, after logging into your Cloudflare account, see the Security -> WAF section (shown below):

The details…
To access and configure Advanced Rate Limiting in Cloudflare, follow these steps:

Log into the Cloudflare Dashboard: Select your domain.
Navigate to the Security Section: Once in the dashboard for your selected domain, click on the “Security” tab to access the WAF features.
Access WAF and Rate Limiting Rules: Within the WAF section, look for the “Custom rules” option.
Create or Modify Rate Limiting Rules: The new rate limiting rules allow you to combine different fields, similar to the functionality of WAF custom rules, offering more granular control over how you manage and mitigate traffic.
Specify Rule Conditions and Actions: When creating a new rule, specify the conditions under which the rule should trigger. This could include the characteristics of the requests you want to limit or block, such as requests from a specific country. Then, choose the appropriate action, such as blocking the requests or applying a managed challenge.
Review and Deploy: After configuring your rules, review them to ensure they meet your requirements, then deploy them.

Blocking countries is particularly easy to set up with custom rules (example below):

How can I test this?

This page on the Cloudflare website, Advanced Rate Limiting: Live Demo, provides a taste of what rules can be set, including a nice test page where you can see what happens when you visit/refresh a web page 10 times; a rate limit rule you might set for a login page: https://www.cloudflare.com/rate-limit-test

If you have experienced an increase in login attempts or attacks on your website I recommend trying out the Cloudflare Advanced Rate Limiting option to help control and block suspicious connections to your website.

What does it cost?

The free plan is rather limited rules-wise, but it does allow you to set up a few free rules to get started.

As far as I’m aware, in 2024, Advanced rate limiting is unmetered, meaning Cloudflare does not charge extra for Advanced Rate Limiting. Here’s a link to their website with more details on the cost of rate-limiting rules.

But what about Cloudflare Page Rules?

Page rules were first promoted by Cloudflare back in 2012. As the name describes, Rules allow one to control how CloudFlare works on your site on a page-by-page basis.

Check out the article, “The future of Page Rules” which describes in more detail how the old page rules at Cloudflare have changed.

As of 2024, Cloudflare has since migrated the prior firewall rules into the new WAF custom rules noted above, which means that users who had previously set up firewall rules will now manage them as WAF custom rules.

Sadly, Cloudflare is rather cloudy on how to use the newly named features, so I recommend logging into your Cloudflare account and trying the varying options to figure out which works best for your website’s security needs.

I hope you’ve enjoyed this article and found it helpful. If you have any questions please feel free to call me anytime. I’m here to help.

About this article: I have no relation to Cloudflare and no content on this page is a paid for promotion.

___

I hope you’ve appreciated this article. Before you move on, I wanted to ask if you would consider buying me a cup of coffee as a thank you. It takes a good bit of time to put together helpful articles, not to mention the energy required to write when I’m not focused on helping people with their hacked websites or security concerns. Thank you for caring!

How Can I Monitor File Changes Within My Website?

Posted on 02.04.24 | Jim Walker | 5 Comments

I get this question quite often after repairing a hacked website and correcting a client’s Google reputation.

“Now that my website is free of malware, how can I monitor my website for file changes as well?”

Well, this is a bit of a delicate subject. Monitoring for file changes is a great idea. Only one problem—most folks simply won’t be able to implement file monitoring.

Have you read the Aesop’s Fables story, “The Boy Who Cried Wolf!”

Even the tamest WordPress blogs have daily file changes. Cache files, plugin updates, and the like may generate frequent file change alerts. And like that boy who cried wolf once too often, many of us will simply begin ignoring those file change notices within the first few weeks of receiving them.

So what is the solution to file monitoring for hacker files and malware?

I like to keep it simple and start by setting up two external content monitors for each of my websites.

ChangeDetection dot com is one of my favorites. See my other article for more details, “Free Website Monitoring Services—well, mostly free…“
Google Webmaster Tools may provide helpful alerts as well, though only as a backup. Waiting for Google to alert you of serious issues can be a tragic error. Lesson learned…

For internal monitoring, there are two WordPress file monitoring plugins discussed on, “Free Website Monitoring Services—well, mostly free…” Both are worth checking out.

Now let’s say you are not a fan of the WordPress plugins mentioned in the link above, or you don’t use WordPress at all. That’s fine, I have a little trick for you.

How to set and monitor your website’s file changes with a cron job command (in less than five minutes!)¹

Most of us have the option to set a cron job within our web hosting company’s control panel. A cron job is composed of two parts, a command and a time to run the command.

On a cPanel server, setup is as quick as clicking the “Cron Jobs” button in cPanel, copy / pasting the text below, then clicking “Add New Cron Job.”

This part means run once per night at midnight:
0 0 * * *

And this part is the command.
The “-ctime -1” text shown below tells the web server to report file changes made in the past 24 hours:
find /home/USERNAME/public_html -type f -ctime -1 -exec ls -ls {} \; | mail -E -s "File Changes, Past 24 Hours" me@my_domain.com

You certainly don’t need a computer science degree to copy / paste the text above, and cron jobs can be added, edited or removed in seconds. For example, set up the cron job then try changing the subject from “File Changes, Past 24 Hours” to “my_domain Files Changed”

After testing the cron job, I recommend setting an email filter or rule within my email software to redirect the email alerts to a custom folder, like this example at right, “my_domain.com File Changes.”

Yes, I know, earlier I said, “…many of us will simply begin ignoring those file change notices within the first few weeks of receiving them.” Well, again, monitoring for file changes can be helpful, particularly if you have a suspicion files are being changed and you’d like proof.

For example, theme files are the files hackers tend to edit first, so instead of receiving alerts for your entire website (/public_html), just monitor your theme’s directory instead (/public_html/wp-content/themes), like this:

find /home/USERNAME/public_html/wp-content/themes/MYTHEME -type f -ctime -1 -exec ls -ls {} \; | mail -E -s “File Changes, Past 24 Hours” me@my_domain.com

How Do I Monitor For File Changes Within My Website or Blog?

I hope that by now I’ve given you some nice food for thought. That said, now that you have external monitoring in place, and possibly internal monitoring using the cron job technique above, you may be asking, “What else can I do to better secure my website or WordPress blog?”

I’ve posted a few basic article links below. Likewise, if you ever have questions just pick up the phone and call me anytime, Jim Walker, The Hack Repair Guy, (619) 479-6637

Notes:
¹ If you make a change to your site and do not receive an email, it may be because your web host is using older software that does not support the -E tag. If so, try removing the -E from the command. The caveat is that you may receive a blank email every day respectively.

Jim Walker’s WordPress Security News

Your Profile. Other color schemes may be set up using this plugin, Admin Color Schemes New theme is greatly changed, with a more magazine like look and feel. Widget management has been improved ...
Read More

‹

1

2

« Previous Page

Blocking the Bad Guys and Bad Bots, Can It Be Done on The Cheap?

Within the WordPress community, I find a lot of folks use a variety of security plugins and methods to secure their websites against denial of service attacks and brute force connections.