Jak řešit napadený WordPress?

[darebacik]

Aj nad tym som uvazoval. S blokovanim IP sa to nedarilo a IP stale pribudalo a CPU sa zatazoval dalej na 10-12%.
Web som hodil za cloudlare. Ale zda sa, ze IP  bombarduju web aj nadalej (len uz v logu vidim IP CF).
Zatial nemam skusenosti s CF, ale asi je to nutne nejak nastavit.
Na obr. top IP za 24 hod.
WP som musel docasne zhodit, inak by som mal CPU uz na 20-30%

[Reklama]

[to_je_jedno]

Zeptej se Google jak tam nastavit geo rules. Mel bys to tam i vidět ve statistikách přístupu (na serveru se nic nedozvíš)

[darebacik]

Google uz neodpoveda ako niekedy, mozno duckduckgo. Ale zatial som sa nepytal.
Na pfsense som mal vytvoreny alias a len som pridaval IPecky a chvilu to drzalo, ale uz ma nebavilo pridavat kazdy den 2-3 IP.
Prevazna cast (cca 70%) IP pochadza z NL (Amsterdam), cize aj na geoIP by sa to dalo nastavit.
Ale uvazujem, ze tento web sa pouziva minimalne a ak sa pouzije, tak ho pouzivaju len klienti zo slovenska.
Aj ked zase klienti mozu byt za nejakym VPN a nebol by som rad ak by im nejak zle nastavene pravidla blokovali web.

Ono CF, to mozno ani nebere ako utok

Kód: [Vybrat]

162.159.113.35 - - [02/Nov/2026:08:27:42 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.23.166.120 - - [02/Nov/2026:08:27:42 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.22.109.32 - - [02/Nov/2026:08:27:42 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.23.168.26 - - [02/Nov/2026:08:27:42 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.70.47.60 - - [02/Nov/2026:08:27:43 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
162.159.113.35 - - [02/Nov/2026:08:27:43 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.71.95.28 - - [02/Nov/2026:08:27:44 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.70.47.60 - - [02/Nov/2026:08:27:45 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.71.98.125 - - [02/Nov/2026:08:27:45 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.23.172.50 - - [02/Nov/2026:08:27:45 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.70.47.60 - - [02/Nov/2026:08:27:52 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
141.101.76.28 - - [02/Nov/2026:08:27:53 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
141.101.76.28 - - [02/Nov/2026:08:27:53 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.70.47.60 - - [02/Nov/2026:08:27:53 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.71.103.12 - - [02/Nov/2026:08:27:54 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.71.103.12 - - [02/Nov/2026:08:27:54 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.71.103.12 - - [02/Nov/2026:08:27:55 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.23.168.26 - - [02/Nov/2026:08:27:55 +0100] "GET /kontakt/ HTTP/1.1" 404 271 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
104.23.170.185 - - [02/Nov/2026:08:27:56 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
172.71.103.12 - - [02/Nov/2026:08:27:57 +0100] "GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0"
Lebo co som zistoval, tak jedna IP utoci radovo 4-5 krat za minutu, ale ked tych IP su desiatky a PHP to musi stale riesit, tak je jasne, ze to cely server vytazuje.

Ako riesia take utoky vacsi poskytovatelia, ked maju stovky az tisice webov a netboti si vyberu formulare, ktore do nekonecna odosielaju (prekonavaju recaptchu prip. Turnstile a pod).
Ja som uz web docasne zrusil a stale

Kód: [Vybrat]

"GET / HTTP/1.1" 200 996 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0

[to_je_jedno]

Tohle fakt neni zadny zaznamenanihodny utok. Proste si tam vypni NL, asii a afriku a uz se tim vic netrap. cas tomu "problemu" venovany je neefektivni.

A google ti fakt krasne odpovi na otazku jak nastavit geograficke blokovani v CF. Pokud se ho na takovou vec neumis spravne zeptat tak vyhod pocitac do elektroodpadu a bez se zivit realne lopatou a krumpacem.

[to_je_jedno]

Ale je teda pravda, ze v holandsku konci ... a ted nevim jestli vodafone nebo ktery velky provider (na firemni vpn v ex-praci mi vzdycky hraly na youtube holandske reklamy)

[Reklama]

[darebacik]

A google ti fakt krasne odpovi na otazku jak nastavit geograficke blokovani v CF. Pokud se ho na takovou vec neumis spravne zeptat tak vyhod pocitac do elektroodpadu a bez se zivit realne lopatou a krumpacem.

Vies ono ja aj s lopatou a krumpacem robim. Toto je len moje hobby. A google na to nepotrebujem aby som v menu videl napisane

Kód: [Vybrat]

Security - Security Rules - Create Rules  + Templatesdik za nakopnutie