DDoS protection and bans

DDoS protection limits how often one visitor can request a site. A visitor who goes over the limit gets a 404 and, by default, a temporary ban. This deals with floods, aggressive scrapers and password-guessing tools that send a stream of requests from one address or a handful of them.

Turn it on in the site’s settings: Advanced tab, DDoS protection.

Settings

Keep the limit generous. A single page with many images, scripts and fonts makes dozens of requests at once, and someone who opens a few pages in quick succession should stay well below the limit. The default of 150 per 10 seconds suits most sites.

How the limit is counted

The limit is a token bucket. Each visitor starts with a full bucket of 150 tokens (the limit), every request takes one, and the bucket refills evenly over the window: with the defaults, 15 tokens per second. A visitor can therefore send up to 150 requests in one burst and then continue at 15 requests per second without a single refusal. The bucket runs dry only for a client that keeps going faster than that.

When the bucket is empty:

• the request gets a plain 404 and the connection is closed;
• if Ban, minutes is not 0, the visitor is banned for that many minutes. During the ban every request gets the same plain 404 without any further checks, which costs the server almost nothing.

Visitors over the limit and banned visitors always get the plain 404 and never a custom block page, because serving a page to every request of a flood would cost more than the flood itself.

IPv6 visitors

An IPv4 visitor is counted and banned by its address. An IPv6 visitor is counted and banned by its /64 network, because a single subscriber usually controls a whole /64 and could otherwise get around a ban by switching addresses. In the list of banned IPs such a visitor shows up as 2001:db8:1:2::/64.

Bans

Bans are per site: a visitor banned on one site can still open your other sites. Bans come from the rate limit and from Bot Fight Mode (probes, attack payloads, fake crawlers, the honeypot, path scanning, each with its own ban time). Banned visitors are blocked as long as either DDoS protection or Bot Fight Mode is on.

In the site’s statistics you can see how many visitors are banned right now, show the list with the reason and the end of each ban, and lift all of them with Unban all. Bans are kept in memory and cleared when the panel restarts.

At most 50 000 bans are held at once, across all sites. If a large distributed attack fills that up, the oldest bans of the site holding the most are lifted early to make room, and the activity log gets a warning (at most once an hour). An address unbanned this way starts from a full bucket again and is banned again if it keeps attacking.

The allow list

The Whitelisted IPs field lists addresses and networks (one per line, for example 198.51.100.7 or 10.0.0.0/8) that the site’s protection never touches.

A listed address is exempt from:

• the rate limit and bans,
• all of Bot Fight Mode, including scan detection,
• Geo-blocking: countries, networks and the browser language,
• the penalty for .htaccess patterns that run too long.

This holds even when the rate limit itself is turned off: the allow list belongs to the whole protection of the site.

It does not exempt from:

• the global blocklist: an explicit block by the panel admin wins over a site’s exemption;
• Allowed devices, Required URL parameters, Password protection and Hotlink protection. These decide who may see the content and have nothing to do with abuse.

Use it for your office, your own monitoring, a payment provider’s callback servers or a partner that crawls your site on purpose.

Canonical forms

Entries are read strictly and stored in one canonical form, so the same address cannot appear twice: 1.2.3.4/32 is stored as 1.2.3.4, FE80::1 as fe80::1, and duplicates are removed. A malformed entry such as 1.2.3.4/ is rejected as an error, so it can never be read as a /0 that matches the whole internet.

Entries saved by older versions that can still be read (198.51.100.0/ 24, 1.2.3.4/) are fixed when the panel starts and when settings are imported; entries that cannot be read are removed. Both are written to the activity log.

Allowing everyone

0.0.0.0/0 (every IPv4 address) and ::/0 (every IPv6 address) are accepted, because sometimes that is what you mean. The panel shows a warning when you save one: such an entry turns off every protection rule of the site for that address family, the rate limit included.

Behind Cloudflare and other proxies

Behind a proxy every request arrives from the proxy’s addresses instead of the visitor’s. The rate limit would then count all your visitors as one, and a single ban would close the site for everybody.

For Cloudflare, turn on Behind Cloudflare in the site settings, and the limit is counted per real visitor. If you forget, WardPane notices that requests come from Cloudflare and does not ban its addresses: each Cloudflare server gets ten times the site’s limit, and a warning goes to the log.

WardPane does not know the addresses of any other proxy or CDN, so do not turn on DDoS protection for a site behind one.