Support » Plugin: Security-Protection » High CPU usage in the midst of botnet attack

  • Resolved ilushkin

    (@ilushkin)


    Entry Processes 30 of 30 – occupied. CPU running up to 100%

    Shared environment.

    I’m in the middle of a major botnet attack (24 hours, every 1 minute – blocked one ip after second attempt) targeting one blog. I do have Limit Login plugin and according to it, since the activation of
    Security-protection plugin, the attack has stopped.

    However, the resources usage is ridiculous. I’m not 100% sure its because of your plugin, but it seems like it is.

    https://wordpress.org/plugins/security-protection/

Viewing 9 replies - 1 through 9 (of 9 total)
  • Thread Starter ilushkin

    (@ilushkin)

    can confirm that deleting your plugin resolves the high cpu usage but the attack resumes.

    Plugin Author webvitalii

    (@webvitaly)

    Thank you very much for your feedback.
    Each time spam-bot sends brute-force request to wp-login.php – the full WordPress site is started. IMHO it is very poor design of WordPress architecture and it is impossible to solve with the plugin.

    Limit-login attempts blocks brute-force requests from same IP but each time it runs whole WordPress site too.

    Security-Protection blocks all brute-force requests too but it also sends fake cookies and fake redirect. Some brute-force attacks rely on this redirect and cookie and stops their attack.

    Security-Protection blocks 100% of brute-force attacks and even stops some of them completely. It is its main benefit among other plugins. Security-Protection also consumes as much CPU resources as other plugins because whole WordPress is started every time. But sometimes Security-Protection consumes less CPU resources because some brute-force attacks are stopped.

    Thread Starter ilushkin

    (@ilushkin)

    спасибо. i will continue gambling without eating up resources. unfortunately, i have a dozen busy sites on that account.

    Thread Starter ilushkin

    (@ilushkin)

    damn attack is continuing and its into 25th hour.

    Plugin Author webvitalii

    (@webvitaly)

    You can rename wp-login.php to ‘wp-login-new.php’ for example.
    But also replace ‘wp-login.php’ with ‘wp-login-new.php’ inside of the wp-login.php file.
    And also put into ‘wp-login.php’ empty file for not starting whole WordPress with 404 error.
    Just don’t forget that now you can login via this link – site.com/wp-login-new.php
    I hope it will help.

    Thread Starter ilushkin

    (@ilushkin)

    You can rename wp-login.php to ‘wp-login-new.php’ for example.
    But also replace ‘wp-login.php’ with ‘wp-login-new.php’ inside of the wp-login.php file.
    And also put into ‘wp-login.php’ empty file for not starting whole WordPress with 404 error.
    Just don’t forget that now you can login via this link – site.com/wp-login-new.php

    Thank you!

    Thread Starter ilushkin

    (@ilushkin)

    PS: Appreciate your help. The attack has stopped.

    Hello webvitaly,

    what do you mean by this:
    And also put into ‘wp-login.php’ empty file for not starting whole WordPress with 404 error

    I have followed your other two steps, but cannot understand this last bit.
    I am under attack on my wp-login and my site has been restricted by hostgator.
    My CPU usage is enormous, they closed down my site basically immediately.

    Any help is so much appreciated

    Plugin Author webvitalii

    (@webvitaly)

    @corrr001: If you will put an empty file called wp-login.php then whole WordPress core will not be executed after each brute-force request.
    You will not be able to login to WordPress site, but you will reduce the load to your hosting.
    Is that more clear to you?

Viewing 9 replies - 1 through 9 (of 9 total)
  • The topic ‘High CPU usage in the midst of botnet attack’ is closed to new replies.