2.4.1.2.7. Flood protection (I'm Under Attack)

Notes:

  • Checking is not performed for IP addresses that are added to the Firewall whitelist.
  • Protection does not block requests from services that publish lists of their IP addresses, such as Google, Bing, OpenAI, and others.
    • There is no way to track services that do not publish their IP addresses, so if the protection is triggered for requests from such a service, simply add its IP to the Firewall whitelist.
  • If the check fails, response 429 is returned.

An anti-flooding system is available on the hosting service to filter out unwanted requests when attacking the site.

Principle of operation

When protection is enabled, a simple JS script is first executed in the browser of the site visitor to determine if the visitor is a human. If the script is successful, the site loads normally, if not — instead of loading the site, a message is displayed that JavaScript must be enabled in the browser to view it. For ordinary visitors, this check goes almost unnoticed.

flowchart LR request@{ shape: stadium, label: "➡️ Request" } whitelist@{ shape: rounded, label: "🧱 Restricted
access mode" } blacklist@{ shape: rounded, label: "📋 IP blacklist" } firewall@{ shape: rounded, label: "🔥 Firewall" } bots@{ shape: rounded, label: "🤖 Bots" } countries@{ shape: rounded, label: "🌎 Countries" } suspicious@{ shape: rounded, label: "🔍 Suspicious IPs" } subgraph iam [🛡️ I'm Under Attack] enabled@{ shape: diamond, label: "Protection
enabled?" } passed@{ shape: diamond, label: "Protection
passed?" } end site@{ shape: stadium, label: "✅ Site" } error_429@{ shape: stadium, label: "🚫 Error 429" } request-->whitelist request-->blacklist whitelist-->firewall blacklist-->firewall firewall-->bots bots-->countries countries-->suspicious suspicious-->enabled firewall-.->site enabled-->|❌|site enabled-->|✅|passed passed-->|✅|site passed-.->|❌|error_429

In the chain of all stages of site protection, I'm Under Attack comes after restricted access mode, IP blacklist, Firewall, bot protection, country access restrictions and checking suspicious IPs.

Configure

Protection is configured individually for each site in the "Site protection" section on the "Main settings" tab using the "I'm Under Attack" parameter:

Protection can be in one of four modes:

  • Protection is disabled and will automatically turn on when flooding — automatic mode, protection is activated when the limit of simultaneous requests is exceeded (see below).
  • Protection is disabled and will not automatically turn on when flooding — protection is completely disabled.
  • Protection is on and will not automatically turn off — protection is always enabled.
  • Protection is enabled automatically and will be automatically disabled when the flood ends — system detected the flooding and enabled protection.
    • This option can be enabled only automatically when our system detects flooding. It cannot be manually enabled, only switched to another option (e.g. when there is a suspicion of a false positive or other protection methods have been implemented for the site).

The "Simultaneous requests limit" field specifies the number of simultaneous requests, which, when exceeded, will automatically activate I'm Under Attack. The minimum value is 10, the maximum on shared hosting is 100, and on business hosting is 200. If protection is completely disabled, the limit has no effect.

Site with protection enabled is marked in the "My sites" section with a shield icon 🛡️.

Content
    (6)