0

I am getting a lot of POST requests to my server that look like this.

5.113.41.160 - - [20/Jun/2016:16:05:20 -0400] "POST / HTTP/1.1" 200 9451 "-" "-"
46.52.87.170 - - [20/Jun/2016:16:05:27 -0400] "POST / HTTP/1.1" 200 9507 "-" "-"
125.108.136.161 - - [20/Jun/2016:16:05:27 -0400] "POST / HTTP/1.1" 200 9451 "-" "-"
125.108.136.161 - - [20/Jun/2016:16:05:28 -0400] "POST / HTTP/1.1" 200 9451 "-" "-"
203.87.144.9 - - [20/Jun/2016:16:05:38 -0400] "-" 408 0 "-" "-"

Is this something that I should be concerned about? The requests keep coming from random IPs but they are all to the root path and they are all HTTP POST requests.

Is there a trick that I can do in my htaccess file to reject these requests?

BeMathis
  • 41
  • 3
  • You can easily set a variable using `SetEnvIf` if the method is anything other than `GET` and block it, redirect it, or do other things with it. This assumes you have a well known structure on your site for where posting should be permitted and by whom. The apache docs show how to use environment variables to change the behavior of the site. Should you be concerned? Perhaps, if they are making changes to your site that you don't expect to be allowed. You didn't provide enough details for anyone to make an informed decision around that. – Aaron Jun 20 '16 at 22:10

1 Answers1

0

It's not harmful, but it wastes bandwidth. You could try the technique in this question.

If the IPs repeat you can obviously block by IP.

Additionally, putting CloudFlare (free or paid) in front of the website might prevent some of the requests coming through, if CF has identified them as security issues. This is probably not going to help, but won't hurt either.

Community
  • 1
Tim
  • 31,888
  • 7
  • 52
  • 78