How to Protect WordPress from Layer 7 DDoS Attacks on Hostinger & Contabo

The Threat of Layer 7 Application DDoS Attacks

Unlike traditional volumetric Layer 3/4 attacks that saturate network bandwidth, Layer 7 (Application Layer) DDoS attacks simulate legitimate browser traffic by sending thousands of simultaneous HTTP GET and POST requests directly to expensive endpoints like /wp-login.php, /?s=search_query, or /xmlrpc.php. These attacks exhaust PHP worker threads and database connection pools, bringing even powerful servers to their knees.

Defense Layer 1: Cloudflare Custom WAF Rules

In your Cloudflare dashboard, navigate to Security -> WAF -> Custom rules. Create the following rules:

• Block XML-RPC: (http.request.uri.path eq "/xmlrpc.php") -> Action: Block.
• Protect WP-Login with Managed Challenge: (http.request.uri.path contains "/wp-login.php") and not (ip.src in {YOUR_HOME_IP}) -> Action: Managed Challenge.
• Rate Limit Site Search: (http.request.uri.query contains "s=") -> Action: Rate Limit (10 requests per minute).

Defense Layer 2: Nginx Connection and Request Rate Limiting

In /etc/nginx/nginx.conf, add rate-limiting memory zones:

limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
limit_conn_zone $binary_remote_addr zone=addr:10m;

Apply to your virtual host:

location / {
    limit_req zone=one burst=15 nodelay;
    limit_conn addr 10;
    try_files $uri $uri/ /index.php?$args;
}