How to Disallow Bad Requests

"Disallowing bad requests" in the context of website security refers to implementing measures to prevent or block HTTP requests that are deemed malicious, suspicious, or indicative of an attack. These requests often carry payloads designed to exploit vulnerabilities, probe for weaknesses, or overwhelm server resources.

It's a proactive security measure that forms a crucial layer of defence for any website, including WordPress sites. By blocking bad requests at an early stage, you can:

• Prevent direct attacks: Block SQL injection attempts, Cross-Site Scripting (XSS), directory traversal, remote code execution, and other common web application attacks.

• Reduce server load: Malicious requests, especially those from bots, can consume significant server resources. Disallowing them frees up resources for legitimate users, improving performance and stability.

• Improve site uptime: By fending off DDoS attacks or brute-force attempts, you help ensure your website remains available to legitimate visitors.

• Enhance data security: Preventing successful attacks means your website's data, including user information and content, is better protected.

• Boost SEO (Indirectly): A secure, fast, and consistently available website signals reliability to search engines, positively impacting your SEO. Websites that are frequently down or compromised can suffer penalties in search rankings.

Types of Bad Requests to Disallow

Bad requests can come in many forms, often identifiable by specific patterns, user agents, or request methods:

• Malicious Payloads: Requests containing strings commonly associated with SQL injection (e.g., ' OR 1=1--), XSS attempts (e.g., <script>alert('XSS')</script>), or remote code execution (e.g., eval().

• Abnormal User-Agents: Requests from known malicious bots, scrapers, or tools with suspicious User-Agent strings.

• Excessively Long Requests: Unusually long URLs or POST data, often indicating an attempt to overflow buffers or smuggle malicious code.

• Forbidden File Access: Attempts to access sensitive files or directories (e.g., .env, /wp-config.php.bak, /wp-includes/).

• Brute-Force Login Attempts: Repeated, rapid requests to login pages (wp-login.php, xmlrpc.php) with different username/password combinations.

• Spam Submissions: Automated attempts to submit spam comments, contact forms, or user registrations.

• DDoS Attacks: A flood of legitimate-looking but overwhelming requests designed to exhaust server resources.

How to Disallow Bad Requests

Disallowing bad requests typically involves a multi-layered approach, using various tools and configurations:

1. Web Application Firewalls (WAFs):

   A WAF is one of the most effective ways to disallow bad requests. It acts as a shield between your website and incoming traffic, inspecting every HTTP request and filtering out malicious ones based on predefined rules.

   • Cloud-based WAFs: Services like Cloudflare, Sucuri, and Wordfence (premium) route your traffic through their servers. They block malicious requests before they even reach your hosting, significantly reducing server load and protecting against large-scale attacks. This is often the most robust solution.

   • Server-level WAFs: Some hosting providers offer server-level WAFs that protect all websites on their infrastructure.

   • WordPress Plugins with WAF capabilities: Plugins like Wordfence Security, iThemes Security Pro, and BBQ Firewall offer application-level WAFs that inspect requests once they hit your server but before WordPress fully processes them. BBQ Firewall, for instance, specifically focuses on blocking bad queries based on patterns.

2. .htaccess Rules (Apache Servers):

   For Apache web servers, the .htaccess file is a powerful tool for disallowing bad requests directly at the server level. This is highly effective because it intercepts requests before they even touch WordPress PHP code, minimising resource consumption.

   • Blocking by IP Address: If you identify specific malicious IP addresses or ranges, you can block them:

     Apache

      

     Order Allow,Deny
     Allow from All
     Deny from 192.168.1.100  # Block a single IP
     Deny from 10.0.0.0/8    # Block an IP range (CIDR notation)
     

   • Blocking by User-Agent: Prevent specific bots or scrapers known for malicious activity:

     Apache

      

     RewriteEngine On
     RewriteCond %{HTTP_USER_AGENT} (BadBot|ScraperXYZ|AnotherEvilBot) [NC]
     RewriteRule .* - [F,L]
     

   • Blocking by Request URI/Query String Patterns: Block requests containing suspicious strings in the URL or query parameters (e.g., common exploit patterns):

     Apache

      

     RewriteEngine On
     # Block common exploit patterns in URL or query string
     RewriteCond %{REQUEST_URI}  (.*)wp-config\.php(.*) [NC,OR]
     RewriteCond %{REQUEST_URI}  (.*)eval\(.*) [NC,OR]
     RewriteCond %{QUERY_STRING} (.*)base64_encode(.*) [NC,OR]
     RewriteCond %{QUERY_STRING} (.*)union+select(.*) [NC,OR]
     RewriteCond %{QUERY_STRING} (.*)concat(.*) [NC,OR]
     RewriteCond %{QUERY_STRING} (.*)etc/passwd(.*) [NC,OR]
     RewriteCond %{QUERY_STRING} (.*)proc/self/environ(.*) [NC,OR]
     RewriteCond %{QUERY_STRING} (.*)(\%24|\%27|\%22|\%3E|\%3C|\%3B|\%7B|\%7B|\%2E|\.\.) [NC,OR] # Various encoded characters
     RewriteRule .* - [F,L]
     

     Caution: Be extremely careful when editing .htaccess. A single mistake can make your site inaccessible. Always back up the file first. Test thoroughly after implementing changes. Overly aggressive rules can also lead to false positives, blocking legitimate users.

3. Nginx Configuration:

   For Nginx servers, similar rules can be implemented directly in the Nginx configuration files (e.g., nginx.conf or your site's specific .conf file). This is generally faster and more efficient than .htaccess for Nginx.

   Nginx

    

   # Block by IP address
   deny 192.168.1.100;
   deny 10.0.0.0/8;
   
   # Block by User-Agent
   if ($http_user_agent ~* "BadBot|ScraperXYZ") {
       return 403;
   }
   
   # Block by URL/Query String patterns (more complex in Nginx, often requires regex)
   # Example for blocking common exploit strings in query string
   if ($query_string ~* "(wp-config\.php|eval\(|base64_encode|union\+select|concat|etc/passwd|proc/self/environ)") {
       return 403;
   }
   

   Caution: Similar to .htaccess, incorrect Nginx configurations can break your site. Always test on a staging environment.

4. WordPress Security Plugins:

   Plugins specifically designed for WordPress security often include features to detect and block bad requests. They manage this through a combination of:

   • Firewall rules: As mentioned earlier.

   • Login attempt limiting: Prevents brute-force attacks by temporarily locking out IPs after too many failed login attempts.

   • Malware scanning: Identifies and removes malicious code that might be generating bad requests from your own server.

   • Honeypots: Lures malicious bots into traps, allowing you to identify and block them.

   • Blacklisting/Whitelisting: Allows you to manually block IPs, user agents, or referrers, or explicitly allow trusted ones.

5. Server-Level Rate Limiting:

   Configuring your web server (Apache or Nginx) to limit the number of requests from a single IP address within a certain time frame can help mitigate brute-force attacks and low-volume DDoS attempts.

SEO Considerations

• Direct Impact: Disallowing bad requests has no direct negative SEO impact. Search engines do not penalise websites for having robust security measures.

• Indirect Positive Impact: The primary SEO benefit is indirect but significant:

  • Improved Site Performance: Blocking malicious traffic reduces server load, allowing legitimate users and search engine crawlers to access your site faster. Page speed is a ranking factor.

  • Enhanced Reliability and Uptime: By preventing attacks that could take your site offline, you ensure consistent availability, which is crucial for SEO. Google prefers stable, accessible websites.

  • Reduced Risk of Penalties: A compromised website that serves malware or redirects users to spam sites will be quickly flagged and penalised by search engines. Disallowing bad requests helps prevent such compromises.

  • Better User Experience: A secure and fast website provides a better experience for users, leading to lower bounce rates and higher engagement, which can indirectly influence SEO.

So disallowing bad requests is a fundamental aspect of website security. By implementing a combination of WAFs, server-level configurations, and robust security plugins, you can significantly enhance your website's resilience against malicious activity, leading to a more secure, performant, and SEO-friendly online presence. Always prioritise thorough testing after implementing any security measures to ensure legitimate traffic is not inadvertently blocked.