Possible database crash in case of DDoS attach

Why don’t you just use a plugin that prevents users from having X amount of failed login attempts? This plugin is just meant to log activities within your WordPress installation, not prevent them from happening or not logging them.

Kind regards,

• This reply was modified 6 years ago by basvandijkk. Reason: added komma
• This reply was modified 6 years ago by basvandijkk.

Hi @basvandijkk and thanks for answering.I don’t really understand your answer, I’m not searching for a plugin that prevents users from failed login attempts, this was not my question. My question has to do with the code of the plugin.
The plugin is doing it fine, except the fact that log the failed attempts into the database. That creates an issue in case of a big website, in case of a large attack in /wp-admin/login.php , the plugin logs (by default) all these attempts, so in case of even a small attack all these logs flood the database and DDoS-ing the website (This action on the application layer called self-DDoS).
I’m just asking from the author of this plugin, if there is any particular function that I can comment, and stop the failed logins, or just in a future upgrade, if they can add an option where we can uncheck this option. While monitoring large scale WordPress installation I had self DDoS cases while using the plugin.
So the point here is, that this is a great plugin, and adding that option, can make it much better.
The other log activity plugins, are large and heavy plugins, with many option that I don’t need, Aryo do exactly what I want to do, except the fact that I described above.

Thanks!

I’ve searched within the plugin for any possibility to disable the database insert from within a theme or child theme but no success. But in case of you commenting it yourself.

The following line can be commented to disabled the plugin from hooking into the filter wp_login_failed.

Line: 76
File: /wp-content/plugins/aryo-activity-log/hooks/class-aal-hook-user.php
Example: //add_filter( 'wp_login_failed', array( &$this, 'hooks_wrong_password' ) );

It would be a great addition to be able to select what notices need to be stored within the database.

• This reply was modified 6 years ago by basvandijkk.
• This reply was modified 6 years ago by basvandijkk.

thanks so much for taking time to look at the code @basvandijkk , thanks so much for the valuable help, yes, looks like there are the needed functions that we need to comment.
I tested so seems like this is doing the trick!
Thank you so much for the help!

I will mark it as resolved, hopefully we will help more people to solve any temporary issue that may have regarding this.
Thanks again @basvandijkk

Thats great, Stefano! Glad I could help.

I know this doesn’t answer the question but if it’s a large website you should have some sort of DDoS protection and/or a rate limit on the wp-login.php endpoint.

Apache(mod_Evasive)/Nginx(Limit_req)/VarnishCache(tbf/token bucket filtering) all have some sort of Request Rate Limiting modules.