How a Business Owner became victim of a DDoS Attack and mitigated using Cloudflare?

News / Updates / Resources
1

Yesterday I found an interesting case on Twitter where a Bhanu Teja who owns the product SiteGPT.ai faced DDoS attacks. Intriguing coincidence, his product was on the front page of Hacker News the previous day.

image
image1460×718 108 KB

And the next day he receives this alert from Cloudflare, while facing alot of spam email user registrations for his product.

image
image640×900 82.1 KB

An ex-Cloudflare employee, Adam helped him mitigate this using the Cloudflare firewall and other features.

image
image607×584 28.2 KB

He made a thread on this as well – https://twitter.com/pbteja1998/status/1642610558120898560

I found this case interesting, and learned more about DDoS attacks.

Cloudflare has a good resource on identifying and fixing DDoS as well – https://community.cloudflare.com/t/mitigating-an-http-ddos-attack-manually-with-cloudflare/302366

Personally, I use a few custom Cloudflare rules to ensure my site remains safe, like rate limiting my login pages of WordPress (1 rule is Free).

image
image600×843 68.8 KB

I hope you all find this helpful.

Did you all ever face DDoS attack on your websites?

3 Likes
2

Thanks for sharing…
If I could help with one of your rules:

/wp-login/ doesn’t really need protecting, but wp-login.php does… ie uri contains wp-login.php
All requests for /wp-admin/ get pushed to wp-login.php anyway.

Your rules above allow for no rate limiting on wp-login.php currently.