473,837 Members | 1,541 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

How do I limit my number of PHP hits per second?

Nu
I want to protect myself from if someone with a fast connection hammers my
site. It's not denial of service attacks, but offline downloaders (of course
that don't show they're offline downloaders in the useragent so I can't
filter them by that). My main issue is my site is PHP so if they hammer it,
it gets all the PHP files executing and overwhelms the CPU. I'd like to be
able to after a certain amount of hits on my index.php per second, so just
refuse.

I can't find how to do that. Can it be done in PHP, htaccess, etc.

Any ideas?

Jan 31 '07 #1
32 4090
"Nu" <no@spam.comkir joitti
viestissä:uE*** *************** **@bgtnsc05-news.ops.worldn et.att.net...
>I want to protect myself from if someone with a fast connection hammers my
site. It's not denial of service attacks, but offline downloaders
Even I have not dealt with this specific issue, I want help by asking these
questions:

1) What info offline downloaders bring to phpinfo():


Jan 31 '07 #2
Rik
Nu <no@spam.comwro te:
I want to protect myself from if someone with a fast connection hammers
my
site. It's not denial of service attacks, but offline downloaders (of
course
that don't show they're offline downloaders in the useragent so I can't
filter them by that). My main issue is my site is PHP so if they hammer
it,
it gets all the PHP files executing and overwhelms the CPU. I'd like to
be
able to after a certain amount of hits on my index.php per second, so
just
refuse.

I can't find how to do that. Can it be done in PHP, htaccess, etc.
I'd say this would have to be done on server-level, anything in PHP would
still need/eat quite some resources.

May I suggest you ask this on alt.apache.conf iguration?
--
Rik Wasmus
Jan 31 '07 #3
Nu wrote:
I want to protect myself from if someone with a fast connection hammers my
site. It's not denial of service attacks, but offline downloaders (of course
that don't show they're offline downloaders in the useragent so I can't
filter them by that). My main issue is my site is PHP so if they hammer it,
it gets all the PHP files executing and overwhelms the CPU. I'd like to be
able to after a certain amount of hits on my index.php per second, so just
refuse.

I can't find how to do that. Can it be done in PHP, htaccess, etc.

Any ideas?
Can't be done. You cannot control what other people on the web
do. You can only control how you react.

Any measure you take against the dishonest folks, you also take
against the honest ones. To that end, there are services out
there who will gladly charge you thousands of dollars to sell
you service packages for several thousand per month. And some
of those might even help to track down your abusive user.

But your best bet is to just make sure you have capacity to
handle peak loads, and that overloaded systems throttle down
gracefully.

Jan 31 '07 #4
Rik wrote:
I'd say this would have to be done on server-level, anything in PHP
would still need/eat quite some resources.
Personally, I do it by primarily serving up static HTML pages,
instead of PHP. I reserve PHP for active content and such.

You can still get hammered, but the PHP system isn't going wild.
Feb 1 '07 #5
Nu
Sanders Kaufman" <bu***@kaufman. netwrote in message
news:yW******** **********@news svr27.news.prod igy.net...
Nu wrote:
I want to protect myself from if someone with a fast connection hammers
my
site. It's not denial of service attacks, but offline downloaders (of
course
that don't show they're offline downloaders in the useragent so I can't
filter them by that). My main issue is my site is PHP so if they hammer
it,
it gets all the PHP files executing and overwhelms the CPU. I'd like to
be
able to after a certain amount of hits on my index.php per second, so
just
refuse.

I can't find how to do that. Can it be done in PHP, htaccess, etc.

Any ideas?

Can't be done. You cannot control what other people on the web
do. You can only control how you react.

Any measure you take against the dishonest folks, you also take
against the honest ones. To that end, there are services out
there who will gladly charge you thousands of dollars to sell
you service packages for several thousand per month. And some
of those might even help to track down your abusive user.

But your best bet is to just make sure you have capacity to
handle peak loads, and that overloaded systems throttle down
gracefully.

Actually, my site goes to index.php and then index.php digs around in other
PHPs and MySQL. If I stop it right at index.php, I can keep my account from
overloading the CPU.


Feb 1 '07 #6
Nu

"P Pulkkinen" <pe************ *************@P OISTATAMA.elisa net.fiwrote in
message news:2N******** ********@reader 1.news.saunalah ti.fi...
"Nu" <no@spam.comkir joitti
viestissä:uE*** *************** **@bgtnsc05-news.ops.worldn et.att.net...
I want to protect myself from if someone with a fast connection hammers
my
site. It's not denial of service attacks, but offline downloaders

Even I have not dealt with this specific issue, I want help by asking
these
questions:

1) What info offline downloaders bring to phpinfo():


I don't understand that question.

Feb 1 '07 #7
"Nu" <no@spam.comkir joitti
viestissä:uE*** *************** **@bgtnsc05-news.ops.worldn et.att.net...
>I want to protect myself from if someone with a fast connection hammers my
site. It's not denial of service attacks, but offline downloaders
Sorry, if I misunderstand or miss something. I understood that you mean
persons that use some batch to fetch the _output_ of your script, perhaps
automaticly on timely basis. But not _download_ it in sense of ftp/scp.

1) Can you use $_SERVER["REMOTE_ADD R"] to identify downloaders from each
other?

2) Does it really matter if they are online or offline, if the POINT is
that some people (or machines) execute your index.php or other script
_too_often_?

3) How about this scenario:
You have two database tables:
DOWNLOADS
- download_id
- filepath
- remote_ip
- timestamp
TROUBLEMAKERS
- remote_ip
- filepath

In the END of every script execution you add an entry to downloads table.
You also check, if that filepath/remote_id-combination has become bad enough
to be inserted into troublemakers table. You use some mathematics to define
characteristics of being evil downloader.

In the BEGINNING of every script, you make a database query to troublemakers
table and if current filepath/remote_id-combination is there, stop the
execution immediately.

Downside here is that mysql traffic increases, even php traffic may
decrease. If they was a way to check evil filepath/remote_id-combinations in
apache side, of course troublemakers table could be replaced with
troublemakers-file as well or a file that would be apache magik with that
data inside.



Feb 1 '07 #8
Nu wrote:
Sanders Kaufman" <bu***@kaufman. netwrote in message
>But your best bet is to just make sure you have capacity to
handle peak loads, and that overloaded systems throttle down
gracefully.

Actually, my site goes to index.php and then index.php digs around in other
PHPs and MySQL. If I stop it right at index.php, I can keep my account from
overloading the CPU.
In that case - you just have to choose one or more methods among
the several (labor-intensive) ones out there.

You can exit based on IP's - but they can be spoofed. You can
exit based on other headers - but they can be spoofed, too.

This is why developers talk so much about "scalabilit y". If
your site isn't designed to handle peak loads, and to exit
gracefully during overload - all of the other measures won't help.

That's usually an OK design flaw behind a firewall, but not out
in open water.

Feb 1 '07 #9
Nu
"Sanders Kaufman" <bu***@kaufman. netwrote in message
news:yp******** ***********@new ssvr27.news.pro digy.net...
Nu wrote:
Sanders Kaufman" <bu***@kaufman. netwrote in message
But your best bet is to just make sure you have capacity to
handle peak loads, and that overloaded systems throttle down
gracefully.
Actually, my site goes to index.php and then index.php digs around in
other
PHPs and MySQL. If I stop it right at index.php, I can keep my account
from
overloading the CPU.

In that case - you just have to choose one or more methods among
the several (labor-intensive) ones out there.

You can exit based on IP's - but they can be spoofed. You can
exit based on other headers - but they can be spoofed, too.

This is why developers talk so much about "scalabilit y". If
your site isn't designed to handle peak loads, and to exit
gracefully during overload - all of the other measures won't help.

That's usually an OK design flaw behind a firewall, but not out
in open water.

So how do I handle peak loads and exit gracefully during overloads?

Basically something like X hits per 10 seconds to index.php sounds simple
enough. I can't find out how to do that, though.

Feb 1 '07 #10

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

6
5796
by: JohnH | last post by:
I have an ASP app (developed with Interdev 6) which uses a DTC listbox (server-side) bound to a recordset to allow the user to make a selection. This works fine until the number of records in the record set seems to hit a limit (not determined the exact limit, but seems to be c. 400). If there are too many records, the app just hangs until it hits the scripttimeout limit. I've tried increasing both the command timout (I'm using an ADO...
3
2178
by: A Seel | last post by:
COUNTING NUMBER OF SELECTS MADE table mytable { id, data, hits }
0
5805
by: D. Dante Lorenso | last post by:
I need to know that original number of rows that WOULD have been returned by a SELECT statement if the LIMIT / OFFSET where not present in the statement. Is there a way to get this data from PG ? SELECT ... ; ----> returns 100,000 rows
0
1877
by: Tomas | last post by:
I have two questions: (1) How (if possible) can you, with ASP.NET (and with the IIS 5 included with win2000) specify an maximum limit of the memory that a web application may consume, as an absolute number of megabytes ??? ( I am aware of the "memoryLimit" attribute in the "processModel" element in the Web.config but that only specifies the maximum allowed memory size, as a percentage of total system memory, and I don't want a...
40
2830
by: RadiationX | last post by:
I have a problem that I really don't understand at all. In my previous post I could get started on my projects I just had a few problems with syntax errors. This problem is something that I don't conceptually understand very well. Here it is: Π – the ratio of the circumference of a circle to its diameter – is one of the most common and important constants in mathematics. It is an irrational number (a real number that cannot be...
1
1592
by: ben07 | last post by:
Hi does anyone know a simple cookie code that records how many times a visitor visits a page, and once it hits a certain number (let say 6). It then blocks the visitor from further accessing the page? A downloading limit of some sort, such as rapidshare.. once you reach a quota you have to wait a couple of minitues until you're able to download. Thats what i'm looking for, but a simple cookie code for the visitors to presever bandwidth. ...
1
1958
by: tom.youdan | last post by:
Hi, I am boiling my brain on this one and struggling with the plethora of responses on this topic. For some reason I can't access the Samples dbs through my Work pc, so I have no help there. Was hoping one of you can put me out of my misery! Right now I have 2 tables. 1) Taskforces - Taskforce ID (Auto number & PKey), Taskforce (Text)
2
2920
by: OM | last post by:
I have two tables, one with categories in it, and only 3 records - Wages, Salary, Contract. I have a second table that records hours and numbers of employees in each category, per month. How do I limit the number of entries for each month to the number of categories ? I only want 1 x Hrs and 1 x Numbers for each category, for each month (the figures are entered each month). I have a form (which has Month as the only field), and a...
30
8323
by: Jeff Bigham | last post by:
So, it appears that Javascript has a recursion limit of about 1000 levels on FF, maybe less/more on other browsers. Should such deep recursion then generally be avoided in Javascript? Surprisingly, deep recursion actually isn't that slow for what I'm doing. Programming this task recursively is so much more straightforward to me, but currently I'm forced to use an ugly hack to avoid going over the 1000 level limit. Of course, it could...
0
9682
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10871
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10268
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9396
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
6998
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5668
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5846
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
2
4039
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
3
3123
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.