The correct value depends on the nature of the attack and typical traffic patterns, so you should experiment, but 300 is a good starting point. If you set this value too low, legitimate connections may be dropped.<\/p>\n\n\n\n
On the same page, you may also want to change the PORTFLOOD value. PORTFLOOD restricts connections to a single port. For example, if a server is attacked on HTTP port 80, the following limits new connections to 50 in ten seconds, blocking subsequent attempts.<\/p>\n\n\n\n
PORTFLOOD = \u201c80;tcp;50;10\u201d<\/p>\n\n\n\n
Finally, the Layer 4 Syn Flood is one of the most common and simple denials of service attacks. SYN flood protection is included in CSF and can be enabled in the Port Flood Settings section of the configuration page.<\/p>\n\n\n\nSYN Flood protection should be enabled, and the SYNFLOOD RATE and SYNFLOOD BURST settings should be adjusted. The default setting may be too high to prevent an ongoing attack. The correct values depend on the attack’s specifics, but 75\/s and 50 are good starting points. Keep in mind that if you set these values too low, legitimate traffic may experience connection issues.<\/p>\n\n\n\n
Syn Flood protection should be enabled only during an attack because it can cause significant network latency.<\/p>\n\n\n\n
<\/span>Mod_Evasive<\/strong><\/span><\/h3>\n\n\n\nMod evasive is an Apache module that provides sophisticated Layer 7 DDoS mitigation capabilities. It detects potential web application attacks and takes evasive action by rate-limiting IP addresses that make too many requests in a short period of time.<\/p>\n\n\n\n
We must first install the mod evasive module. Navigate to the Software menu in WHM and select Easy Apache 4. Navigate to the Apache Modules tab, type “mod evasive,” and hit the install button.<\/p>\n\n\n\nAfter that, go to the Review Tab, scroll to the bottom of the page, and click Provision. The module and its dependencies may take a few seconds to install in WHM.<\/p>\n\n\n\n
The module has reasonable defaults, but you may want to modify the configuration file, which is located on the server’s filesystem at:<\/p>\n\n\n\n
\/etc\/apache2\/conf.d\/300-mod evasive.conf<\/p>\n\n\n\n
Set an email address in the DOSEmailNotify section if you want mod evasive to send an email when it blocks an IP. The comment symbol (#) at the beginning of the line may need to be removed.<\/p>\n\n\n\n<\/span>The cPanel IP Blocker<\/strong><\/span><\/h2>\n\n\n\ncPanel includes an IP Blocker that can be used to block individual addresses as well as ranges of addresses. Manual IP blocking is not practical for a large distributed attack, but it may be useful for smaller attacks. IP Blocker can be found in the security menu of cPanel.<\/p>\n\n\n\nDDoS attacks are an unfortunate reality for web hosting providers. They have grown in size and ease of execution over time. Between 2018 and 2019, the number of attacks more than doubled, and we can expect this trend to continue as long as there is money to be made by threatening the livelihoods of legitimate web hosts and site owners. Fortunately, with cPanel and WHM, as well as some planning, you can fight back and keep your users safe.<\/p>\n","protected":false},"excerpt":{"rendered":"
DDoS attacks have the potential to bring any website offline. Even Google and GitHub, with their vast resources,…<\/p>\n","protected":false},"author":1,"featured_media":1115,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[158],"tags":[],"class_list":["post-1026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-troubleshooting"],"_links":{"self":[{"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/posts\/1026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/comments?post=1026"}],"version-history":[{"count":3,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/posts\/1026\/revisions"}],"predecessor-version":[{"id":1114,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/posts\/1026\/revisions\/1114"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/media\/1115"}],"wp:attachment":[{"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/media?parent=1026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/categories?post=1026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harmonweb.com\/blog\/wp-json\/wp\/v2\/tags?post=1026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}