DDoS Protection & Rate Limiting

Protecting Your Site from DDoS Attacks

Distributed Denial of Service (DDoS) attacks overwhelm your server with traffic. BlitzPress provides multiple layers of protection through Cloudflare, OLS, and fail2ban.

Layer 1: Cloudflare (Recommended)

Cloudflare sits in front of your server and absorbs most DDoS traffic before it reaches you.

• Under Attack Mode: Enable during active attacks. Adds a 5-second JavaScript challenge for all visitors. Go to Cloudflare dashboard > Overview > Under Attack Mode.
• Rate Limiting Rules: Create rules to limit requests per IP. Example: 100 requests per minute to /wp-login.php.
• IP Access Rules: Block entire countries or ASNs known for bot traffic.

Layer 2: OLS Connection Limits

OpenLiteSpeed has built-in per-client connection and bandwidth throttling. In httpd_config.conf:

tuning {
  maxConnections          10000
  maxSSLConnections       10000
  connTimeout             300
  maxKeepAliveReq         10000
  keepAliveTimeout        5

  # Per-client throttling
  perClientConnLimit {
    staticReqPerSec         40
    dynReqPerSec            10
    outBandwidth            0
    inBandwidth             0
    softLimit               500
    hardLimit               1000
    gracePeriod             15
    banPeriod               60
  }
}

Key settings:

Setting	Description
staticReqPerSec	Max static file requests per second per IP
dynReqPerSec	Max dynamic (PHP) requests per second per IP
softLimit	Connection count that triggers throttling
hardLimit	Connection count that triggers ban
banPeriod	How long to ban the IP (seconds)

Layer 3: fail2ban Rate Rules

Create a custom fail2ban jail to ban IPs that make too many requests:

# /etc/fail2ban/filter.d/ols-ratelimit.conf
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"
ignoreregex = \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)

# /etc/fail2ban/jail.d/ols-ratelimit.conf
[ols-ratelimit]
enabled   = true
port      = http,https
filter    = ols-ratelimit
logpath   = /home/*/logs/access.log
maxretry  = 300
findtime  = 60
bantime   = 3600

Layer 4: Kernel-Level Protection

Tune kernel parameters for better DDoS resilience:

# /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 65535
net.core.somaxconn = 65535
net.ipv4.tcp_fin_timeout = 15

Apply with: sudo sysctl -p

During an Active Attack

1. Enable Cloudflare Under Attack Mode immediately
2. Check sudo ss -s for connection counts
3. Identify attacking IPs: sudo ss -tn | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head
4. Block at firewall level: sudo ufw deny from ATTACKING_IP