Impact on server load caused by brute-force attacks

I have examined the load reduction performance against brute-force attacks by using IP Location Block. I report the result in this article.

A shell program

The attack.sh is a shell program that measures the load of malicious burst accesses to WordPress back-end such as wp-comments-post.php, xmlrpc.php, wp-login.php, wp-admin/admin-ajax.php using ApacheBench.

It gives an emulation of spam comment, pingback spam, login attempt, and malicious access to the admin-ajax with 5 multiple requests at a time
throughout 60 seconds.

Test environment

I set up the testbed in my local PC which specifications are followings:

And here are the plugins installed in the above environments:

Speaking generally, it is better to separate the hardware on each side of requesting and responding because those have an influence on each other. But unfortunately, I don’t have any such rich environments. So please take it into consideration when you see the results.

Plugins configuration

Wordfence has a lot of options. So I leave them just after installation.

On the other hand, options for IP Location Block 0.2.1.5 are changed as follows:

The results

At the beginning of each test, the DB was optimized using Optimize Database after Deleting Revisions.

I picked up only “Requests per second”, “Time per request (across all concurrent requests)” from the results of ApacheBench which indicate the performance of load reduction. The higher in “Requests/sec” and the lower in “Time/req [ms]” are better.

The “IGB” means “IP Location Block”, “WFS” means “Wordfence Security”. And “ON” indicates “Activate” and “OFF” indicates “Deactivate”.

wp-comments-post.php

xmlrpc.php

wp-login.php

When both “IGB” and “WFS” are “ON”, I got the following email:

A user with IP address WWW.XXX.YYY.ZZZ has been locked out from the signing
in or using the password recovery form for the following reason: Exceeded
the maximum number of login failures which is: 20. The last username they
tried to sign in with was: ‘admin’

where “WWW.XXX.YYY.ZZZ” is an IP address which is set by attack.sh. And there are no validation logs in IP Location Block. It means that the execution priority of Wordfence is higher than IP Location Block.

wp-admin/admin-ajax.php

Conclusion

Speaking about the site performance, more plugins leads to less speed. The results show that the performance of load reduction by IP Location Block against brute-force attacks is not so outstanding, but I think it minimizes a rise of the load.