How to prevent DDoS attacks?

[Harrison76]

Hi everyone, lately it seems that my forum is undergoing several DDoS attacks, which are causing my database CPD to saturate and the forum also requires 30 - 40 seconds to open a page.
Is there any way to prevent them so that I don't have to intervene every time to unblock the situation?
Thank you

[P_I]

DDos attacks are not really a phpBB question, they are more a hosting question.

That said, have you looked that phpBB's Who is online and in particular make sure you 'Display guests' and then look at the Guest User-Agent strings.

There are a number of recent topics here regarding specific bots/crawlers such as Claudebot, GoogleOther, Chinese scrappers to name a few, and some ideas on how to manage them in ACP->General->Spiders and Robots or other mitigation methods.

[thecoalman]

A DDoS attack is on purpose, as mentioned by P_I it's likely just bots running amok.

Whether it's a real DDoS or malicious bots the best way to manage them is through a third party service like Cloudflare, especially for DDoS. Unfortunately that is not something easy to setup and deploy easily.

[HB]

Whether it's a real DDoS or malicious bots the best way to manage them is through a third party service like Cloudflare, especially for DDoS. Unfortunately that is not something easy to setup and deploy easily.

I use Cloudflare at the "free" tier level. You can define web application firewall rules, though it's limited to 5. Prompted by this thread, I searched a bit and read this Cloudflare blog from last year: Easily manage AI crawlers with our new bot categories. In the past, I used user agent one-by-one matches to tame bots that don't respect robots.txt; this option makes it easier to "bundle" blocking rules (e.g., AI bots).

Setting up for Cloudflare does require more technical knowledge, e.g., understanding how the host/CDN topology works. But it does have the advantage of dealing with unwanted requests before they reach your server versus .htaccess rules or phpBB-based bot limiting schemes.

[Harrison76]

yes, in fact I have installed cloudeflare and at the moment I have solved it: if a peak occurs I block the entire country, and everything goes back to normal, then I go to see what caused it and create a new specific filter and then unblock the country
I was trying to understand if there is something automatic to block harmful bots, or if it is worth creating a new rule based on frequency: how did you do it?
Thank you

[KevC]

You're better off asking on a cloudflare support site.

[HB]

...is there something automatic to block harmful bots, or if it is worth creating a new rule based on frequency: how did you do it?

You can handle "panic" cases programmatically with the Cloudflare API. For example, if the server CPU usage goes off the charts, you can temporarily set the security level to "under_attack":

https://developers.cloudflare.com/api/o ... el-setting

This will result in all incoming requests being challenged. You can change the default challenge level for a country in the dashboard under Security > WAF > Tools. For example, you might change the default to "Managed Challenge" for countries that are (a) high spam risk and (b) you have few members from that country participating.

[thecoalman]

if a peak occurs I block the entire country, and everything goes back to normal,

For countries with a lot of bad activity the JS challenge is quite effective. It's practically seamless for regular users so you can just leave it enabled.

I was trying to understand if there is something automatic to block harmful bots,

The pro plan and up has automated tools for malicious bot activity.

[Forex Station]

Cloudflare free plan will stop DDoS. We've got their pro plan as we were getting attacked a lot and felt better purchasing it last year but free plan is that good there's really no need to purchase the pro plan.