logoalt Hacker News

jmuguy • yesterday at 9:19 PM • 1 reply • view on HN

I really ought to do something like this rather than just allowing our logs to endlessly fill with requests for wp-admin.

Replies

Bender • yesterday at 11:33 PM

Another version if this if the 301 is too much is to just close the connection then have a daemon or cron job shove their IP into a NFTables ipset or blackhole route them. Be sure to have exclusion elements so one can not block their own gateway or corporate SNAT groups.

    location ~* /(xmlrpc|wp-login\.php|wp-admin) { set $ban 1; return 444 ''; }

    # grep banip /etc/nginx.conf
    log_format banip '$remote_addr';

    # grep banip /etc/nginx/http.d/some-server.conf
    access_log /var/log/nginx/ban.log banip if=$ban;