@feditips a DDoS attack on them or something I assume they mean?

@feditips

good luck, hope someone awesome is helping

#fediverse #peerSupport #mastdon #feditips

@feditips

Hey. Attacks (usually DDOS attacks) are the responsibility of the webhost to mitigate; they're the only ones with the tools to do so (unless you're renting an entire server, which I assume you don't). If your host can't or won't handle this problem, it may be time to switch hosts. I haven't had a DDOS attack yet, but my website became very popular on Reddit for a hot second, which amounted to the same thing, and my provider handled the load themselves.

@feditips Still need help? I'm a WordPress hosting expert and would be glad to assist if I can.

@feditips
Best I can say is put it behind Cloudflare. Who is your hosting provider?

@feditips immediate recommendation is to install the wordfence plugin then as others have mentioned check with your host but specifically ask what version of php are they using and if not the latest see if they can change it for you. Sometimes you can yourself actually. Also for sure check for any and all WordPress updates (plugins and themes too) backing things up first.
It's possible there's just a coding issue too, something incompatible.

@feditips

Not using #Wordpress, but hosting own projects.

What are the suggestions of your hosting provider?

Any details about your hosting and the attack?

@feditips WordPress does not sit well if hosting provider drastically oversells computing reaources. I used to see huge spikes in CPU usage related to MySQL, but moving to different host revealed regular traffic was just fine. As for DDoS, better choose provider with already integrated protection.

@feditips we're a web host and very experienced with resolving Wordpress attacks. It's frankly a horrifically insecure platform if left as a stock, out of the box install!

Get in touch via our website if you're still having issues. Happy to jump on and investigate for you. https://www.qweb.co.uk

At the very least, a well configured Wordfence is a good start. My plugin, https://github.com/qwebltd/wordpress-admin-country-allowlist will block admin panel and XMLRPC access to countries that don't need it, too. Fail2Ban as a bonus.

@feditips
I removed my website URLs from Mastodon a month or so ago when I noticed they were drawing an increased number of attacks, most of which could be traced back to Mastodon clients.