Hi forum experts,

 

I just wonder do you guys ever have 404 Documents Not Found occur in your C-Panel statistic?

 

What does the error mean?

 

Hope to hear some advice.

 

Thanks!

Sounds like it's recording hits on your 404 page, which means there's a broken link somewhere.

Hi Tangara

 

Yes, absolutely, and the bigger the website, the more you will find.

Not always due to missing documents or broken links either, but often due to hackers trying to find things on your website that they "think" they can exploit.

 

You would be amazed how many 404's used to be in our error logs, we regularly check over them, and the IP's trying to access them and simply blacklist all the high risk countries. Since we started blacklisting by high risk country, the 404's dropped off by 90%..

(This was many many years ago now since we started doing this)

 

Also, ever since starting this, malicious network traffic also dropped significantly too, as did the number of websites being attacked...

 

You may well see people trying to access random files, .sql files or /MySQL/ or /phpmyadmin/ directories that you dont have, but as long as your hosting is secure, you can ignore those, and if those requests are coming from high risk countries, then you could even block the entire IP range.

Edited October 23, 201213 yr by wesh.co.uk

Hi Tangara

 

Yes, absolutely, and the bigger the website, the more you will find.

Not always due to missing documents or broken links either, but often due to hackers trying to find things on your website that they "think" they can exploit.

 

You would be amazed how many 404's used to be in our error logs, we regularly check over them, and the IP's trying to access them and simply blacklist all the high risk countries. Since we started blacklisting by high risk country, the 404's dropped off by 90%..

(This was many many years ago now since we started doing this)

 

Also, ever since starting this, malicious network traffic also dropped significantly too, as did the number of websites being attacked...

 

You may well see people trying to access random files, .sql files or /MySQL/ or /phpmyadmin/ directories that you dont have, but as long as your hosting is secure, you can ignore those, and if those requests are coming from high risk countries, then you could even block the entire IP range.

 

Hello Wesh,

 

Thank you for sharing your experience with me.

 

Indeed there are alot of IP addresses from countries like Russia etc.

 

I'll see what I can do to do the blocking. Thanks again.

Start with this in your .htaccess:

 

# 5G BLACKLIST/FIREWALL
# @ http://perishablepress.com/5g-blacklist/
# 5G:[QUERY STRINGS]
<ifModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} (environ|localhost|mosconfig|scanner) [NC,OR]
RewriteCond %{QUERY_STRING} (menu|mod|path|tag)\=\.?/? [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini  [NC,OR]
RewriteCond %{QUERY_STRING} echo.*kae  [NC,OR]
RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
RewriteCond %{QUERY_STRING} \=\\%27$   [NC,OR]
RewriteCond %{QUERY_STRING} \=\\\'$    [NC,OR]
RewriteCond %{QUERY_STRING} \.\./	  [NC,OR]
RewriteCond %{QUERY_STRING} \?		 [NC,OR]
RewriteCond %{QUERY_STRING} \:		 [NC,OR]
RewriteCond %{QUERY_STRING} \[		 [NC,OR]
RewriteCond %{QUERY_STRING} \]		 [NC]
RewriteRule .* - [F]
</ifModule>
# 5G:[uSER AGENTS]
<ifModule mod_setenvif.c>
SetEnvIfNoCase User-Agent ^$ keep_out
SetEnvIfNoCase User-Agent (casper|cmsworldmap|diavol|dotbot)   keep_out
SetEnvIfNoCase User-Agent (flicky|ia_archiver|jakarta|kmccrew) keep_out
SetEnvIfNoCase User-Agent (libwww|planetwork|pycurl|skygrid)   keep_out
SetEnvIfNoCase User-Agent (purebot|comodo|feedfinder|turnit)   keep_out
SetEnvIfNoCase User-Agent (zmeu|nutch|vikspider|binlar|sucker) keep_out
<limit GET POST PUT>
 Order Allow,Deny
 Allow from all
 Deny from env=keep_out
</limit>
</ifModule>
# 5G:[REQUEST STRINGS]
<ifModule mod_alias.c>
RedirectMatch 403 (https?|ftp|php)\://
RedirectMatch 403 /(cgi|https?|ima|ucp)/
RedirectMatch 403 /(Permanent|Better)$
RedirectMatch 403 (\=\\\'|\=\\%27|/\\\'/?|\)\.css\()$
RedirectMatch 403 (\,|//|\)\+|/\,/|\{0\}|\(/\(|\.\.\.|\+\+\+|\||\\\"\\\")
RedirectMatch 403 \.(cgi|asp|aspx|cfg|dll|exe|jsp|mdb|sql|ini|rar)$
RedirectMatch 403 /(contac|fpw|install|pingserver|register)\.php$
RedirectMatch 403 (base64|crossdomain|localhost|wwwroot|e107\_)
RedirectMatch 403 (eval\(|\_vti\_|\(null\)|echo.*kae|config\.xml)
RedirectMatch 403 \.well\-known/host\-meta
RedirectMatch 403 /function\.array\-rand
RedirectMatch 403 \)\;\$\(this\)\.html\(
RedirectMatch 403 proc/self/environ
RedirectMatch 403 msnbot\.htm\)\.\_
RedirectMatch 403 /ref\.outcontrol
RedirectMatch 403 com\_cropimage
RedirectMatch 403 indonesia\.htm
RedirectMatch 403 \{\$itemURL\}
RedirectMatch 403 function\(\)
RedirectMatch 403 labels\.rdf
RedirectMatch 403 /playing.php
RedirectMatch 403 muieblackcat
</ifModule>
# 5G:[bAD IPS]
<limit GET POST PUT>
Order Allow,Deny
Allow from all
# uncomment/edit/repeat next line to block IPs
# Deny from 123.456.789
</limit>