Server getting slammed...what can I do?

linkup

• November 14, 2025 03:24

I was trying to add a Wordpress post on a community bulletin board I maintain.  I kept getting nonsensical errors so I went into WHM and found several domains were getting hammered.  As a temporary measure, I suspended the domains causing the most problems and rebooted the server to clear things up.  That only helped for a few minutes before the craziness began again.

The highest consuming services are similar to this:

/opt/cpanel/ea-php74/root/usr/bin/php-cgi

/opt/cpanel/ea-php73/root/usr/bin/php-cgi

php-fpm: pool (domain name)

This last one, the pool error was the most prevalent until I suspended the domains affected.

I just hate it when someone is messing with my server....how can I stop whatever it is they are doing?

I am running an older version...CentOS v7.9.2009 STANDARD

It is my understanding I need to upgrade to Alumalinux.  Is there a security issue with my older CentOS that is allowing this to happen?

Thanks

Lew

• 

  cPRex Jurassic Moderator

  • November 14, 2025 16:48

  Hey there!  It's unlikely to be a security issue causing this as it sounds like a DoS attack of some sort.  Can you check your server logs to see if you see entries similar to the following?

  https://support.cpanel.net/hc/en-us/articles/360052130134-How-can-I-tell-if-Apache-is-experiencing-a-DDoS-attack

  Running "apachectl fullstatus" would also likely show if Apache is using an unusually large number of resources.

  You can also try installing mod_evasive, which may help with smaller attacks: https://support.cpanel.net/hc/en-us/articles/360053581353-How-to-install-mod-evasive

  but for larger attacks you may need to work with your host for more advanced solutions as outlined here: https://support.cpanel.net/hc/en-us/articles/360051121953-What-should-I-do-if-my-server-is-experiencing-DDoS

  0
• 

  linkup

  • November 14, 2025 21:42

  Thanks for all the links.  I installed mod_evasive and I blocked the most abused IP address...however, I still getting hammered with:

  GET /photos/picture.php

  I have a really boring event photo site...it is a constant barrage of GETs on that domain.  It is a large list of IP addresses, but primarily 202.76 and 146.174

  What I don't understand is even after suspending the domain, the GETs continue?

  Thanks!

  0
• 

  cPRex Jurassic Moderator

  • November 15, 2025 04:23

  Just because the domain is suspended doesn't mean that the bots still don't have the address in their system.  I can still walk up to a house even when the door is locked - the bot traffic will still reach the server but the request will just be dropped.

  You could always block the entire IP ranges you mentioned to see if that helps to calm things down.

  0

Please sign in to leave a comment.