Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

If someone sets up a script that constantly runs something such as

wget http://domain.tld/image.png

from their cloud server or whatever that came with tons of bandwidth and so on for free, could they exhaust your own bandwidth on your server? If so, what would be the solution to stop something like this?

I suppose there does not exist solution given that in this era most web sites use things such as CAPTCHA in order to verify if someone is an actual human being or a robot..

So perhaps this in itself is evidence that there can not be a solution to bandwidth exhausting thieves and etc.

share|improve this question

marked as duplicate by chaos, slm Jul 18 '14 at 21:59

This question was marked as an exact duplicate of an existing question.

Sounds like you want a sort of IDS with automatic firewall rules. Look into things like fail2ban. – Patrick Jul 11 '14 at 1:45
You can limit bandwidth by service by using a QoS packet scheduler – Deryck Jul 11 '14 at 4:21
Do you have more details like the Operating System you are using or the http server so we could thing on a solution that involves QoS or Connection Per Second limit? – nwildner Jul 11 '14 at 16:54
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} wget [NC]
RewriteRule .* - [F]
share|improve this answer
What does this have to do with the question? – Patrick Jul 11 '14 at 1:44
@Patrick The question is "how to stop people from wgetting my website all day long". This is a rule that (I think) detects wget via user agent and forwards all requests to nowhere – Michael Mrozek Jul 11 '14 at 1:47
Ah, ok. If that is indeed the case, this needs an explanation. Also the OP said things "such as" not "exactly this", and these looks like apache httpd rules, in which OP didn't say he was using apache httpd. – Patrick Jul 11 '14 at 1:49
So in order to block repeated uses of wget, you suggest blocking all uses of wget? What about curl? What about someone who runs Javascript in a browser that repeatedly accesses the site? What if the attacker uses the wget option that allows them to change their User-Agent string? – Barmar Jul 11 '14 at 20:02