Introduction

WordPress powers over 40% of all websites on the internet, making it a massive target for cyberattacks — especially DDoS (Distributed Denial of Service) attacks. These attacks flood your server with fake traffic, causing your site to slow down or crash completely. In this guide, we’ll walk through how to protect your WordPress site against this growing threat.

What is a DDoS Attack?

A DDoS attack is when attackers use a network of infected devices (botnets) to send a massive volume of traffic to your website. The goal is to exhaust your server’s resources — bandwidth, CPU, or memory — making the site unavailable to legitimate users by overloading the network, application, or server.

"A successful DDoS attack can bring your site offline for hours or even days, affecting your revenue and reputation."

Types of DDoS Attacks

• Volumetric Attacks: Overwhelm the server with massive traffic.
• Protocol Attacks: Exploit weaknesses in network layers (e.g., TCP SYN floods, generic UDP flood).
• Application Layer Attacks: Target WordPress-specific features like login pages, search endpoints, or general HTTP flood attacks.

Free Methods of Defending Your WordPress Site

1. Block Suspicious IPs Using .htaccess

   If you're using Apache, the .htaccess file allows you to block known malicious IP addresses manually:

   <Limit GET POST PUT DELETE OPTIONS HEAD TRACE CONNECT>
       order allow,deny
       allow from all
       deny from 192.168.1.100
       deny from 203.0.113.45
   </Limit> 

   Use server logs or access logs to identify abusive IPs.

2. Limit Request Frequency with mod_evasive or Fail2Ban

   On a Linux server, you can install tools to help rate-limit abusive traffic:

   • sudo apt install libapache2-mod-evasive — Apache-based rate limiting
   • sudo apt install fail2ban — Monitor and ban IPs that flood resources

   These work without needing WordPress plugins.

3. Disable XML-RPC

   XML-RPC is a known attack vector for DDoS and brute-force attempts. Disable it by adding the following to your functions.php file:

   add_filter('xmlrpc_enabled', '__return_false');

   Or block access via your web server config:

    # Apache .htaccess
   <Files xmlrpc.php>
       Order Deny,Allow
       Deny from all
   </Files> 

4. Protect wp-login.php and wp-admin

   Option 1 — Restrict by IP: Allow access only from your own IP address using .htaccess:

    <Files wp-login.php>
       order deny,allow
       deny from all
       allow from YOUR.IP.ADDRESS.HERE  
   </Files> 

   Option 2 — Set HTTP Authentication: Add a password prompt using .htpasswd and .htaccess.

5. Disable REST API for Unauthenticated Users

   Add this to your functions.php to limit public REST API access:

   add_filter('rest_authentication_errors', function($result) 
   {
      if (!is_user_logged_in()) 
      {
   	return new WP_Error('rest_cannot_access', 'REST API restricted.', array('status' => 403));
      }
   	
       return $result;
   });

6. Use Static Caching

   Static file caching reduces server load dramatically:

   • Apache: Use mod_expires and mod_headers to cache static assets
   • Nginx: Set long expiry headers for images, CSS, and JavaScript files

7. Reduce Server Exposure

   • Disable directory listing by adding Options -Indexes to your .htaccess
   • Use minimal and clean themes to reduce the number of requests
   • Limit the number of external scripts and plugins loaded on your pages

WordPress site under attack now?

If you are actively experiencing a DDoS attack, here are some actions you can take now:

• Use some of the free methods listed at the top of this post to try to mitigate the attack
• Use EvoShield remote WordPress DDoS protection to bring an immediate stop to the attack.
• Migrate your WordPress website to an Evolution Host VPS and apply a WordPress protection profile.

Final Thoughts

DDoS attacks on WordPress sites are disruptive — but preventable. While using server hardening techniques such as the ones listed above can be effective in some cases, it is generally recommended to use a dedicated WordPress DDoS protection service so that you can keep your WordPress site online during attack attempts. Proactive protection is far more effective (and cheaper) than reacting after your site has already gone offline.

Stay safe, stay updated — and don’t wait until it's too late to secure your WordPress site with DDoS protection.

688312fd03495688312fd03496688312fd03497688312fd03498