As DDoS attacks become less expensive, they are becoming more common. Finding an effective ddos defense method is a problem that every website needs to pay attention to these days. There are many types of DDoS attacks. The most basic DDoS attack is to use reasonable service requests to occupy too many service resources, so that legitimate users cannot get services. If you want to effectively prevent ddos , you can properly test the bearing capacity of the server.
1. Ensure the security of the server system
The first thing to do is to ensure that the server software does not have any vulnerabilities to prevent attackers from entering. Make sure the server is up-to-date with security patches. Remove unused services on the server, closing unused ports. For a website running on a server,
Make sure it has the latest patches and no security holes.
2. Hide the real IP of the server
The front-end of the server is added with CDN transit (for free, there are Baidu Cloud Acceleration, 360 Website Guard, Acceleration Music, Safe Bao, etc.), if you have sufficient funds, you can buy a high-defense shield to hide the real IP of the server, and use CDN for domain name resolution. IP,
All resolved subdomains use the CDN's IP address. In addition, other domain names deployed on the server cannot be resolved using real IP, and all are resolved using CDN.
In addition, to prevent the server from leaking IP when transmitting information to the outside world, the most common thing is that the server does not use the sending email function. If you have to send emails, you can send them through a third-party proxy (such as sendcloud), so that the IP displayed to the outside world is the IP of the proxy.
In short, as long as the real IP of the server is not leaked, the prevention of DDOS with small traffic below 10G does not cost much, and the free CDN can handle it. If the attack traffic exceeds 20G, then the free CDN may not be able to withstand it, and you need to purchase a high-defense DDoS firewall to deal with it.
If you want to know how much traffic pressure your server can withstand, you can perform the ddos stress test appropriately. The ddos stress test is a single-machine flood generator. The principle is to instantly generate thousands of reasonable http requests, so as to achieve the effect of the target server being unavailable. , 90% of the sites can hang. So don't open it often, otherwise the website will be paralyzed.