Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This question already has an answer here:

If someone sets up a script that constantly runs something such as

wget http://domain.tld/image.png

from their cloud server or whatever that came with tons of bandwidth and so on for free, could they exhaust your own bandwidth on your server? If so, what would be the solution to stop something like this?

I suppose there does not exist solution given that in this era most web sites use things such as CAPTCHA in order to verify if someone is an actual human being or a robot..

So perhaps this in itself is evidence that there can not be a solution to bandwidth exhausting thieves and etc.

share|improve this question

marked as duplicate by chaos, slm Jul 18 at 21:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Sounds like you want a sort of IDS with automatic firewall rules. Look into things like fail2ban. –  Patrick Jul 11 at 1:45
    
You can limit bandwidth by service by using a QoS packet scheduler –  Deryck Jul 11 at 4:21
    
Do you have more details like the Operating System you are using or the http server so we could thing on a solution that involves QoS or Connection Per Second limit? –  nwildner Jul 11 at 16:54

1 Answer 1

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} wget [NC]
RewriteRule .* - [F]
share|improve this answer
    
What does this have to do with the question? –  Patrick Jul 11 at 1:44
    
@Patrick The question is "how to stop people from wgetting my website all day long". This is a rule that (I think) detects wget via user agent and forwards all requests to nowhere –  Michael Mrozek Jul 11 at 1:47
2  
Ah, ok. If that is indeed the case, this needs an explanation. Also the OP said things "such as" not "exactly this", and these looks like apache httpd rules, in which OP didn't say he was using apache httpd. –  Patrick Jul 11 at 1:49
    
So in order to block repeated uses of wget, you suggest blocking all uses of wget? What about curl? What about someone who runs Javascript in a browser that repeatedly accesses the site? What if the attacker uses the wget option that allows them to change their User-Agent string? –  Barmar Jul 11 at 20:02