Shared Hosting Nightmare

[artfulweb]

Hello everyone,
I am looking desperately for a solution... Actually on IONOS and having been happy there for 12 years on a shared server, suddenly in the past month I am getting constant errors 500. Looking in my who's online there are tens of thousands of "visitors" (ips from places i do not sell to: the middle east, south america, asia, eastern block countries, africa...) and of course with the overload I can not connect to my phpAdmin on Ionos between 5pm till well after after midnight. Ionos tells me it is not a DDoS attack, just regular traffic and that my CMS should have an app to control that as it is not their responsibility even though this weekend the site was hacked! I already had some ip and bot blocking done in .htaccess but now the number of connections per day is totally out of control These are not bots as far as I can see as I had already a very extensive bad bot blocking set up.

Any help would be greatly appreciated as customers are fleeing the website and I have brain fog from the stress, just can't think anymore.

Thank you in advance

[burt]

I -think- the answer is Cloudflare - but I cannot give any more help than that as I know very little about what it is or how it works. Hopefully someone else will chip in with some better advice.

[artfulweb]

I -think- the answer is Cloudflare - but I cannot give any more help than that as I know very little about what it is or how it works. Hopefully someone else will chip in with some better advice.

Have been trying to figure Cloudflare out but it is much harder than I could have imlagined and their instructions say get help from the hoster which is a real dead end!

[artfulweb]

Need to find a book entitled Cloudflare for Dummies, lol!

[burt]

I plugged this thread into my favoured AI, and it came back with this.
Please note that I have no clue if this is good advice or not!

Hopefully someone will be in the forum tomorrow who has more experience with Cloudflare..

============================

Here is an immediate, step-by-step action plan to mitigate the traffic surge, restore access to your site, and secure your shop.

---

### Step 1: Immediate Emergency Lockdown via `.htaccess`

Since IONOS shared hosting resources are exhausted by incoming connections, you can temporarily block non-target geographic regions or aggressive traffic at the server level while setting up Cloudflare.

1. Access your web server via **FTP/SFTP** (using FileZilla or similar) since phpMyAdmin and hosting panels may be timing out.
2. Open your root `.htaccess` file.
3. **Block direct IP access or aggressive user agents:**
Ensure you have bot protection rules at the very top of your `.htaccess` file:


# Block common scraper/bad bot user agents
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|curl|wget|python|nikto|scan|clshttp|archiver|loader|email|harvest|extract|grab) [NC]
RewriteRule ^ - [F,L]



---

### Step 2: Simplified Cloudflare Setup ("Cloudflare for Dummies")

Cloudflare acts as a proxy shield between incoming visitors and your IONOS server. It absorbs automated attack traffic, filters bad bots, and serves cached content before requests ever reach IONOS.

#### 1. Create and Add Your Site

1. Go to [Cloudflare.com](https://www.cloudflare.com) and create a free account.
2. Click **Add a Site** and enter your domain name (e.g., `yourdomain.com`).
3. Select the **Free Plan** and click **Continue**.

#### 2. Verify DNS Records

1. Cloudflare will automatically scan your existing DNS records.
2. Ensure your domain's primary `@` (A record) and `www` (CNAME or A record) have the **Orange Cloud icon** enabled ("Proxied").

#### 3. Update Nameservers at IONOS

1. Cloudflare will provide **two nameservers** (e.g., `ada.ns.cloudflare.com` and `bob.ns.cloudflare.com`).
2. Log in to your **IONOS Control Center**.
3. Go to **Domains & SSL** > Select your domain > **Nameservers**.
4. Change from **IONOS Nameservers** to **Custom Nameservers** and paste the two Cloudflare nameservers provided.
5. Save changes. *(DNS propagation typically takes 15–60 minutes).*

---

### Step 3: Activate High-Protection Security Rules in Cloudflare

Once your domain is active on Cloudflare, enable these settings immediately:

1. **Turn on Under Attack Mode:**
* Go to **Security** > **Overview**.
* Toggle **"Under Attack Mode"** to **ON**.
* *Effect:* Every visitor will see a 5-second JavaScript browser check before entering the site. This stops almost 100% of automated flood traffic instantly.


2. **Enable Bot Fight Mode:**
* Go to **Security** > **Bots**.
* Toggle **Bot Fight Mode** to **ON**.


3. **Block Unwanted Countries / Regions (Custom Firewall Rule):**
* Go to **Security** > **WAF** > **Custom Rules**.
* Click **Create Rule**.
* **Rule Name:** Block Non-Target Countries
* **Field:** *Country*
* **Operator:** *does not equal*
* **Value:** Select the countries you actually sell to (e.g., *United Kingdom*, *United States*, etc.).
* **Action:** Choose **Block** or **Managed Challenge**.
* Save and Deploy.



---


### Step 4: Prevent Server IP Bypass

Once Cloudflare is active, traffic can still hit your server directly if attackers know your IONOS origin IP address.

1. **Restrict Direct Access:** Configure `.htaccess` to only allow incoming connections from Cloudflare's IP ranges (or use Cloudflare Authenticated Origin Pulls if supported).
2. **Request an IP Change from IONOS:** If attacks persist directly to the server IP bypassing Cloudflare, ask IONOS support to reassign your shared account to a new primary IP address after Cloudflare is set up.

[azpro]

Cloudflare might be overwhelming in the beginning - especially if you are in a stress situation not really knowing what is the cause and what to do to tackle the problem. (as I have been ...) ... But I believe Cloudflare is essential - you can not do without in this time of scrapers/bots (AI - SEO etc) ....

With the help of first my hoster (to get Cloudflare working - I have a dedicated server which might work better - I don't know for a shared server) and second a lot of help form ChatGPT it worked for us .... still learning but at least we get the feeling we can control situations where we have floods of scrapers.

I wish you succes and keep calm!

[14Steve14]

We had a similar problem a few months back and were getting hit really hard from AI bots and scrapers. facebook was the worse. We were getting 503 lack or resources errors and were told to try Cloudflare by our hosts. We tried cloudflare and after about 3 weeks the problem was still there. Cloudflair support were very little help and kept pushing us to upgrade, and our hosts would not help as it was no longer anything to do with them.

In the end we tried adding in the 8g firewall from perishable press https://perishablepress.com/8g-firewall/ plus their badbot list. They do have a blackhole for bots but we are yet to need that. After a few false starts and needing the help from chatgpt we eventually got everything back to our normal nameservers and with 8g firewall working fine. We added loads of bots and scrapers into our robots text, which most ignored, and then went and blocked certain urls though our hosting and through htaccess. You can find the persistent ones using the visitors log in cpanel if you have it.

Everything seems to have calmed down a bit now and we are not having as many problems as we were and I cant remember when we last had any 503 errors.

[artfulweb]

I plugged this thread into my favoured AI, and it came back with this.
Please note that I have no clue if this is good advice or not!

### Step 1: Immediate Emergency Lockdown via `.htaccess`

Since IONOS shared hosting resources are exhausted by incoming connections, you can temporarily block non-target geographic regions or aggressive traffic at the server level while setting up Cloudflare.

1. Access your web server via **FTP/SFTP** (using FileZilla or similar) since phpMyAdmin and hosting panels may be timing out.
2. Open your root `.htaccess` file.
3. **Block direct IP access or aggressive user agents:**
Ensure you have bot protection rules at the very top of your `.htaccess` file:


# Block common scraper/bad bot user agents
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|curl|wget|python|nikto|scan|clshttp|archiver|loader|email|harvest|extract|grab) [NC]
RewriteRule ^ - [F,L]

Step 1 does not work at all, so will plow on to step 2 in hopes that I can reach my Ionos count.

[azpro]

Step 1 does not work at all

.. are you sure?

Did you upload your entire .htacces to eg chatGPT to ask whether your .htaccess is solid/without mistakes?
Did you check you uploaded your last .htacces to server?
Did you check the date and time of .htaccess on your server?

[ecartz]

2. Ensure your domain's primary `@` (A record) and `www` (CNAME or A record) have the **Orange Cloud icon** enabled ("Proxied").

Should also do the AAAA records for @ and possibly www (CNAME replaces both A and AAAA). Modern bots may use IPv6 (AAAA) instead of IPv4 (A).

Note that step 1 is heavily reliant on finding the user agent that the bot is actually using. You'd do this by uploading your access log to the AI for analysis.