Development: Using Caddy to deter brute force attacks in WordPress

[basil (Basil Hendroff)]

@francislavoie If you’re happy with the revised update, I’ll update the issue on the WP doc tracker.

Thanks for persevering with me in nutting out something for handling no referrer requests. On reflection, it’s just so important to test out code and not make any assumptions about its validity. I’ve been burnt

A couple of points to wrap up…

@francislavoie

I’ll be honest I wasn’t 100% paying attention cause I don’t super care about WordPress

You’re killing me!

@francislavoie

The important part is to block POST requests from clients who were not actually on the login page when sending it (e.g. bots… but again, in no way fool-proof)

I actually think the code you’ve designed is quite useful. Unless the bot injects the host into Referrer, the code seems like it will do a pretty good job of rejecting comment and login spam.

In my travels around the web while trying to get my head around this issue, I stumbled on the following GitHub repo GitHub - Stevie-Ray/referrer-spam-blocker: Apache, Nginx, IIS, uWSGI, Caddy & Varnish blacklist + Google Analytics segments to prevent referrer spam traffic 🤖. Interestingly, the spam db was updated just over a week ago. Curiously, the Caddy component is only applicable to V1.

The reason I brought this up wanted to understand the two very different approaches. The spam blocker seems like it would require a lot of work just to try to keep the spam db up to date. Wouldn’t the Caddy code developed here achieve the same result without having to maintain a spam db?

[francislavoie]

@basil

I actually think the code you’ve designed is quite useful. Unless the bot injects the host into Referrer, the code seems like it will do a pretty good job of rejecting comment and login spam.

Sure… just saying that people who are writing bots, that have more than two brain cells, will not be deterred by this.

@basil

In my travels around the web while trying to get my head around this issue, I stumbled on the following GitHub repo GitHub - Stevie-Ray/referrer-spam-blocker: Apache, Nginx, IIS, uWSGI, Caddy & Varnish blacklis. Interestingly, the spam db was updated just over a week ago. Curiously, the Caddy component is only applicable to V1.

That’s… actually insane. The performance cost from adding that to your config is not worth it. The amount of comparison checks your server would need to do on every request is not worth it. “Throwing out the baby with the bathwater” comes to mind.

I think it has a different purpose though. Trying to block requests that came from users being linked to your site from those domains or something. The thing we have above is specifically blocking bots from hammering login/comment forms.

Idk, to me that just looks stupid and I’d rather ignore it