Learn How to Inhibit a DDoS Attack on WordPress

WordPress is one of the most popular website builder in the world because it offers powerful features and secure codebase. However, that does not protect WordPress or any other software from malicious DDoS attacks, which are common on the internet.
DDoS attacks can slow down websites and eventually make them inaccessible to users. These attacks can be targeted towards both small and large websites
Now, you may be wondering how can a small business website using WordPress to prevent such DDoS attacks with limited resources?
In this guide, we will show you how to effectively stop and prevent a DDoS attack on WordPress. Our goal is to help you learn how to manage your website security against a DDoS attack like a total pro.

What is a DDoS Attack?

DDoS attack, short for Distributed Denial of Service attack, is a type of cyber attack that uses compromised computers and devices to send or request data from a WordPress hosting server. The purpose of these requests is to slow down and eventually crash the targeted server.

DDoS attacks are an evolved form of DoS (Denial of Service) attacks. Unlike a DoS attack, they take advantage of multiple compromised machines or servers spread across different regions.
These compromised machines form a network, which is sometimes called a botnet. Each affected machine acts as a bot and launches attacks on the targeted system or server.
This allows them to go unnoticed for a while and cause maximum damage before they are being blocked.

In 2018, GitHub, a popular code hosting platform, witnessed a massive DDoS attack that sent 1.3 terabytes per second traffic to their servers.
You may also remember the notorious 2016 attack on DYN (a DNS service provider). This attack got worldwide news coverage as it affected many popular websites like Amazon, Netflix, PayPal, Visa, Airbnb, The New York Times, Reddit, and thousands of other websites.

Why DDoS Attacks Happen?.

There are several motivations behind DDoS attacks. Below are some common ones:

■Technically savvy people who are just bored and find it adventurous

■People and groups trying to make a political point

■Groups targeting websites and services of a particular country or region

■Targeted attacks on a specific business or service provider to cause them monetary harm

■ To blackmail and collect ransom money

What is the difference between a Brute Force Attack and a DDoS Attack?

Brute Force Attacks are usually trying to break into a system by guessing passwords or DDoS attacks are purely used to simply crash the targetted system making it inaccessible or slowing it down
For details see our guide on how to block brute force attacks on WordPress with step by step instructions.

What damages can be caused by a DDoS attack?

DDoS attacks can make a website inaccessible or reduce performance. This may cause bad user experience, loss of business, and the costs of mitigating the attack can be in thousands of dollars.

Here is a breakdown of these costs:

■Loss of business due to inaccessibility of website

■Cost of customer support to answer service disruption related queries

■Cost of mitigating attack by hiring security services or support

■The biggest cost is the bad user experience and brand reputation

How to Stop and Prevent DDoS Attack on WordPress

DDoS attacks can be cleverly disguised and difficult to deal with. However, with some basic security best practices, you can prevent and easily stop DDoS attacks from affecting your WordPress website.
Here are the steps you need to take to prevent and stop DDoS attacks on your WordPress site.

Remove DDoS / Brute Force Attack Verticals

The best thing about WordPress is that it is highly flexible. WordPress allows third-party plugins and tools to integrate into your website and add new features.
To do that WordPress makes several APIs available to programmers. These APIs are methods in which third-party WordPress plugins and services can interact with However, some of these APIs can also be exploited during a DDoS attack by sending a ton of requests. You can safely disable them to reduce those requests.

Disable XML RPC in WordPress

XML-RPC allows third-party apps to interact with your WordPress website. For example, you need XML-RPC to use the WordPress app on your mobile device.
If you’re like a vast majority of users who don’t use the mobile app, then you can disable XML-RPC by simply adding the following code to your website’s .htaccess file

1. # Block WordPress xmlrpc.php requests
2. Files xmlrpc.php
3. order deny,allow
4. deny from all
5. Files

For alternate methods, see our guide on how to easily disable XML-RPC in WordPress

Disable REST API in WordPress

The WordPress JSON REST API allows plugins and tools the ability to access WordPress data, update content, and/or even delete it. Here is how you can disable the REST API in WordPress.
First thing you need to do is install and activate the Disable WP Rest API plugin. For more details, see our step by step guide on how to install a WordPress plugin.
The plugin works out of the box, and it will simply disable the REST API for all non-logged in users.

Activate WAF (Website Application Firewall)

Disabling attack vectors like REST API and XML-RPC provides limited protection against DDoS attacks. Your website is still vulnerable to normal HTTP requests. While you can mitigate a small DOS attack by trying to catch the bad machine IPs and blocking them manually, this approach is not very effective when dealing with a large DDoS attack.
The easiest way to block suspicious requests is by activating a website application firewall.
A website application firewall acts as a proxy between your website and all incoming traffic. It uses a smart algorithm to catch all suspicious requests and block them before they reach your website server.

We recommend WordPress development company because they all provide the best WordPress security plugin and website firewall. It runs on a DNS level which means they can catch a DDoS attack before it can make a request to your website
Note: Website Application Firewalls (WAFs) that run on an application-level are less effective during a DDoS attack. They block the traffic once it has already reached your web server, so it still affects your overall website performance.

Finding Out Whether it’s Brute Force or DDoS Attack

Both brute force and DDoS attacks intensively use server resources, which means their symptoms look quite similar. Your website will get slower and may crash.
You can easily find out whether it is a brute force attack or a DDoS attack by simply looking at Sucuri plugin’s login reports.
Simply, install and activate the free Sucuri plugin and then go to Sucuri Security » Last
Logins page.

If you are seeing a large number of random login requests, then this means your wp-admin is under a brute force attack. To mitigate it, at this time you can go for WordPress development services. It helps you to increase security in WordPress

Things to Do During a DDoS Attack

DDoS attacks can happen even if you have a web application firewall and other protections in place. Companies like techno software deal with these attacks on a regular basis, and most of the time you will never hear about it since they can easily mitigate it.
However in some cases, when these attacks are large, it can still impact you. In that case, it’s best to be prepared to mitigate the problems that may arise during and after the DDoS attack.
Following are a few things you can do to minimize the impact of a DDoS attack.

Alert your team members

1. If you have a team, then you need to inform co-workers about the issue. This will help them prepare for customer support queries, look out for possible issues, and help out during or after the attack.

2. Inform customers about the inconvenience

A DDoS attack can affect user experience on your website. If you run a WooCommerce store, then your customers may not be able to place an order or login to their account. You can announce through your social media accounts that your website is having technical difficulties and everything will be back to normal soon.
If the attack is large, then you can also use your email marketing service to communicate with customers and ask them to follow your social media updates. If you have VIP customers, then you might want to use your business phone service to make individual phone calls and let them know how you’re working to restore the services.
Communication during these tough times make a huge difference in keeping your brand’s reputation strong.

3. Contact Hosting and Security Support

Get in touch with your WordPress hosting provider. The attack you may be witnessing could be part of a larger attack targetting their systems. In that case, they will be able to Contact your Firewall service and let them know that your website is under a DDoS attack. They may be able to mitigate the situation even faster and can provide you with more information.
In firewall providers like Sucuri, you can also set your settings to be in Paranoid mode which helps block a lot of requests and make your website accessible for normal users.

Keeping Your WordPress Website Secure

WordPress is quite secure out of the box. However, as the world’s most popular website builder it is often targeted by hackers.
Luckily, there are many security best practices that you can apply on your website to make it even more secure.
We hope this article helps you to secure WordPress and improve security

Author’s bio

Arllen Joy serves as a digital marketing manager in a leading IT company in Malaysia Softwares and there he handles all works related to SEO, Content Writing and Email Marketing Works