Attack Scale

Between 3 AM and 6 AM this morning, we encountered a wave of DDoS attacks, which is the highest record so far and worth recording:

Number of Attack Requests:

Attack Bandwidth:

Number of Attackers:

Attacker Sources:

Attack Type

This attack was a direct attack targeting the ”/wp-admin/admin-ajax.php” path, which indeed hit me hard because WordPress's comment function relies on AJAX calls. I cannot apply managed challenges to this path (otherwise people wouldn't be able to comment). Previous attacks on my blog's admin-ajax.php were mainly indirect attacks initiating AJAX calls through TranslatePress (see article:Home Data Center Series: Solving the WordPress AJAX Protection Dilemma: Using Cloudflare Tunnel to Achieve Normal Website Access and ”Shunting” Protection of Attack Traffic), but I have already blocked that path. This time it was actually a direct attack, and Cloudflare blocked the vast majority of it:

However, there were still many attacks that did not reach the global rate limit entering the internal network. This part of the requests was filtered by the internal WAF:

But some requests still ended up reaching the origin server, because my tolerance for admin-ajax.php access was still too high:

It seems I can't leave these loopholes open in the future.

Both the ”number of attack requests” and ”attack bandwidth” mentioned earlier in the article involve uncached ”requests”. This raises a question: why are there only 18.29k uncached requests in Cloudflare's statistics, while there are up to nearly 2 million requests on my internal WAF? I think there are 3 possible reasons:

• Cloudflare excludes intercepted requests (such as those triggering WAF rules, rate limits, DDoS protection, etc.) from “uncached requests”.
• Attack tools may make multiple attempts on the same resource (such as admin-ajax.php), resulting in duplicate connections. For example, if an attacker sends a request and receives a 429 or other rate-limiting response, the tool automatically retries. The origin server will record multiple times, but Cloudflare only counts the initial request.

This kind of detail doesn't really matter anymore~.

Note 1: The statistical information visible on a Cloudflare Free account is too limited, which is quite annoying.

Note 2: The features of the free internal WAF are still too limited. Previously, I removed the load balancing behind the WAF because I felt it wasted resources, but now it seems there is still a need to add it back.

Note 3: This time it actually caused issues for my blog, forcing me to spend 1 second restarting the WordPress Docker container. I'm an honest person and will definitely admit it, but honestly, there's really no technical skill involved.