Title: Response delay tactic depletes PHP processes
Last modified: August 22, 2016

---

# Response delay tactic depletes PHP processes

 *  Resolved [Rolf Allard van Hagen](https://wordpress.org/support/users/ravanh/)
 * (@ravanh)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/)
 * Hi,
 * After running this plugin, I found that the response delay upon failed login 
   attempts is fine against small attacks but if there is a full blown brute-force
   attack going on, the web server runs out of available PHP processes very quickly.
   It starts responding with “Bad Gateway” or “Service Unavailable” messages depending
   on server setup.
 * I am guessing in a large scale attack all processes are hogged for about 25 to
   60 seconds (at least with the default plugin settings) by the delayed response.
   As soon as the max number of PHP processes has been reached, ALL subsequent requests
   get denied. And this included normal page requests!
 * So effectively, this plugin turns a brute-force attack into a denial of service
   attack 😉
 * Kidding aside, I’d like to propose that the second tier uses a different method:
   return a simple 503 or 403 response instead of an increased response delay.
 * In the mean time I’m forced to switch back to Limit Login Attempts because I 
   cannot afford a plugin bringing my sites down, even as a measure of protection
   🙁
 * [https://wordpress.org/plugins/login-security-solution/](https://wordpress.org/plugins/login-security-solution/)

Viewing 5 replies - 1 through 5 (of 5 total)

 *  Plugin Author [Daniel Convissor](https://wordpress.org/support/users/convissor/)
 * (@convissor)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/#post-5183576)
 * Yeah. I know this is a problem. I’m contemplating ways to fix it.
 *  Thread Starter [Rolf Allard van Hagen](https://wordpress.org/support/users/ravanh/)
 * (@ravanh)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/#post-5183592)
 * Hi Daniel, that’s good news.
 * My proposal would be
 * > … that the second tier uses a different method: return a simple 503 or 403 
   > response instead of an increased response delay.
 *  [burneplasmafire](https://wordpress.org/support/users/burneplasmafire/)
 * (@burneplasmafire)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/#post-5183675)
 * I’ve decided to try out the Limit Attempts plugin and it seems like an effective
   solution for the moment. But I’m keen to see what you come up with for a new 
   version of LSS.
 *  Plugin Author [Daniel Convissor](https://wordpress.org/support/users/convissor/)
 * (@convissor)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/#post-5183695)
 * Oh, I forgot to mention. If you set the “Match Time” setting to 0 “disables Login
   Failure slow downs, notifications and breach confirmations.”
 *  Plugin Author [Daniel Convissor](https://wordpress.org/support/users/convissor/)
 * (@convissor)
 * [11 years, 8 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/#post-5183701)
 * Release 0.47.0 includes code that stops the delays after the “DoS Tier” setting
   is reached. Default value, 500.

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Response delay tactic depletes PHP processes’ is closed to new replies.

 * ![](https://s.w.org/plugins/geopattern-icon/login-security-solution.svg)
 * [Login Security Solution](https://wordpress.org/plugins/login-security-solution/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/login-security-solution/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/login-security-solution/)
 * [Active Topics](https://wordpress.org/support/plugin/login-security-solution/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/login-security-solution/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/login-security-solution/reviews/)

 * 5 replies
 * 3 participants
 * Last reply from: [Daniel Convissor](https://wordpress.org/support/users/convissor/)
 * Last activity: [11 years, 8 months ago](https://wordpress.org/support/topic/response-delay-tactic-depletes-php-processes/#post-5183701)
 * Status: resolved