0

If someone sets up a script that constantly runs something such as

wget http://domain.tld/image.png

from their cloud server or whatever that came with tons of bandwidth and so on for free, could they exhaust your own bandwidth on your server? If so, what would be the solution to stop something like this?

I suppose there does not exist solution given that in this era most web sites use things such as CAPTCHA in order to verify if someone is an actual human being or a robot..

So perhaps this in itself is evidence that there can not be a solution to bandwidth exhausting thieves and etc.

Improve this question
3
  • Sounds like you want a sort of IDS with automatic firewall rules. Look into things like fail2ban.
    – phemmer
    Jul 11, 2014 at 1:45
  • You can limit bandwidth by service by using a QoS packet scheduler
    – Deryck
    Jul 11, 2014 at 4:21
  • Do you have more details like the Operating System you are using or the http server so we could thing on a solution that involves QoS or Connection Per Second limit?
    – user34720
    Jul 11, 2014 at 16:54

1 Answer 1

Reset to default
-5 
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} wget [NC]
RewriteRule .* - [F]
Improve this answer
4
  • What does this have to do with the question?
    – phemmer
    Jul 11, 2014 at 1:44
  • @Patrick The question is "how to stop people from wgetting my website all day long". This is a rule that (I think) detects wget via user agent and forwards all requests to nowhere
    – Michael Mrozek
    Jul 11, 2014 at 1:47
  • 3
    Ah, ok. If that is indeed the case, this needs an explanation. Also the OP said things "such as" not "exactly this", and these looks like apache httpd rules, in which OP didn't say he was using apache httpd.
    – phemmer
    Jul 11, 2014 at 1:49
  • So in order to block repeated uses of wget, you suggest blocking all uses of wget? What about curl? What about someone who runs Javascript in a browser that repeatedly accesses the site? What if the attacker uses the wget option that allows them to change their User-Agent string?
    – Barmar
    Jul 11, 2014 at 20:02