Troubles with the site

[phoo]

well, that's f*cked. I tried connecting from a new browser and got in some weird loop where it was sending me to the new expired session page. So I took out that code. And instantly we had almost 2k bots (but at least the site wasn't slow...).


~Patrick

[phoo]

What a conundrum. Turned the new code back on, number of bots immediately drops back down. But if it's hard to connect to the site for legitimate users, what's the point? :/

I'll give cloudflare a try and see what happens there.


~Patrick

[phoo]

I've removed the code that redirects to expired.htm because that had set me into some bizarre loop that I had to do "a thing" that nobody else ever would have thought of to break out of it. But I left in the code that I think is part of what is causing the bots to go crazy. We'll see if it works. The number of bots immediately shot up (boggles my mind, tbh), but the site still seems quite responsive, so we'll see what happens.


~Patrick

[phoo]

I'm glad to see actual users showing up now, so that's good! And the number of bots is dropping back down and the site is fully responsive, so... <crosses fingers>


~Patrick

[smdub]

Working here again.
Yeah, I pointed out the SSL thing ages ago.

[juddspaintballs]

Yep, I got stuck in that loop after I posted everything was working. Thanks for fixing it.

[phoo]

Okay, current strategy, since the site locked up while I was playing hockey last night --

I've signed up for the free tier of Cloudflare. Maybe it'll work, maybe it'll need the $20/mo version to get the "defense against 'not easily identifiable bots'" feature instead of just "block 'easily identifiable bots'" that the free tier gets. This is already active, but it could take 24 hours for people's DNS records to get updated to go through Cloudflare instead of direct.

On the "accessing the site directly instead of cloudflare" note, clearly some/many bots are still using the old DNS entry pointing straight at the site because as soon as I turned off the splash screen, the number of guests shot up to 2000 again. Rather than going back to the splash screen, I had the thought where I would re-enable the old redirect code to instead of pointing to the "expired session" page, it redirects to the front page. I think this will be better and avoid the infinite redirect loop previously experienced because I think that once you are logged in, the loop is broken based upon the code. Then again, as I type this, I realize that could still be the case because I suspect that you won't be able to get to the login page if this odd loop occurs. *sigh*

BTW, for the curious -- this is what we're dealing with. We are not alone. https://www.phpbb.com/community/viewtop ... 08600ac302


~Patrick

[phoo]

lol, okay that was entirely foreseeable. My cellphone got into the "expired session" tango, which caused the browser to hit the "expired" code, get redirected to "/", where it hit the "expired" code, which redirected me to "/", which hit the "expired" code, which... And my browser gave up as it should.

So I've removed that code again.

Back to the "we're not alone" -- https://www.phpbb.com/search/?q=bots (sort by date)

It seems everyone and their brother is beating up the Internet with crappy AI bots looking for data. People have been having good results with Cloudflare's free service, perhaps with some WAF settings added. I'm going to avoid using "under attack mode" for now, and I'm going to give CF some time to propagate and see what happens before I do anything.


~Patrick

[phoo]

Oh, CF's analytics are fun. I didn't know we were so popular in Singapore, Brazil, and Vietnam :eyeroll: --

Top Traffic Countries / Regions
Previous 24 hours
Country / Region Traffic
Singapore 65,337
Brazil 21,877
Vietnam 18,059
Indonesia 1,846
United States 1,316

[phoo]

I tried to use CF's URL redirects to shuffle those three countries plus a specific type of URL over to the "expired" page, but I couldn't get it to actually trigger. So I finally threw in the towel and enabled CF's "under attack" mode. This is why you had to click the checkbox to get in. But, it seems to be working, and you should only have to click on the box once / once in a while. I'll keep trying to be more clever (like enabling that checkbox only for "offensive countries"), but for now I'm going to call it "done enough" and go mow the lawn then work on bikes. I have a pile of them that need maintenance.

Let me know if you have problems again, and if you have problems feel free to text me.


Thanks,

~Patrick