How To Protect Your System From Flooding In Shopware

The Most Popular Extension Builder for Magento 2

With a big catalog of 224+ extensions for your online store

A distributed denial-of-service (DDoS) attack or flooding allows a hacker to overwhelm a network or server with fake traffic. Too much traffic strains the system’s capacity and causes connection problems, preventing it from processing legitimate customer requests. Services become unavailable, resulting in extended downtime, financial loss, and disgruntled consumers for the target organization. That’s why today’s tutorial will show you how to protect your system from flooding in Shopware.

Table of Contents:

Why do you need to prevent flooding in Shopware?
How to protect your system from flooding in Shopware
Final Words

Why do you need to prevent flooding in Shopware?

DDoS is an abbreviation for distributed denial of service. However, it is often referred to as a fundamental denial of service. A DDoS attack involves flooding a website with requests in a short period of time to overload the site and cause it to collapse. The ‘distributed’ aspect indicates that these assaults are being launched from numerous sites simultaneously, as opposed to a DoS, which is launched from a single location. If your site is subjected to a DDoS assault, you will get hundreds of requests from different sources over the course of minutes, if not hours. These requests are not the result of a sudden increase in traffic to a website; they are automated and will originate from a restricted number of sources, depending on the scope of the assault.

DDos - flooding attack

Although the two may be related, a DDoS assault is not the same as hacking; the perpetrators do not seek to access your website’s files or admin but instead force it to crash or become susceptible owing to the number of requests. In some circumstances, this will be followed by efforts to hack the site when it is vulnerable, but in the vast majority of cases, the goal is merely to stop it from operating. It may seem that there is no way to escape a DDoS attack: after all, if someone chooses to overwhelm your site with requests, there isn’t much you can do. Although there is nothing you can do to prevent someone from trying to destroy your site with a DDoS assault, there are actions you can take to guarantee that if you are subjected to such an attack, your site will not stop running and will not be exposed to hackers.

How to protect your system from flooding in Shopware

As a result of the information provided in this part, your system will be safeguarded against floods. Flooding occurs when a large number of requests are sent to a server in a short period of time, causing the server to struggle to cope with the workload. The system now limits these requests in accordance with the guidelines outlined below.

Users who have registered, as well as guests and administrators, may attempt to log in up to ten times before being denied access by the system:

Customers must wait 10 seconds before attempting to log in again after ten unsuccessful login attempts.
After 15 unsuccessful login attempts, the timeout is 30 seconds.
After 20 unsuccessful login attempts, the timer expires after 60 seconds.

Set up login option

The time limit is reset after a successful login or after 24 hours without a failed login attempt.

Configure Contact form

The client may submit three contact forms in succession before the system delays the customer’s response:

After submitting three contact forms, the consumer must wait 30 seconds before submitting a fourth form.
It takes 60 seconds after submitting five contact forms.
After submitting ten contact forms, the time is 90 seconds.

Configure Contact form

After 24 hours, the time restriction is re-established.

Set up Password reset

Users of the storefront and administration have three attempts to change their password before the system delays them:

After three unsuccessful login attempts, the user is required to wait 30 seconds before attempting to log in for the fourth time.
After five unsuccessful login attempts, the timer is set to 60 seconds.
After ten unsuccessful login attempts, the timer is set to 90 seconds.

Set up Password reset

After 24 hours, the time restriction is re-established. If you want to know how the Storefront view will be displayed, go to this link.

Adjust Configuration

There is no adjustment for configuration in the admin, so in order to make changes, you must copy the following file core /framework/resources/config/packages/shopware.yaml to your shop root directory under config/packages/shopware.yaml. Once the file has been copied, you can edit it to enable or disable a function as follows:

login: Customers who have registered may access the storefront by entering their username and password.
guest_login: Login to the storefront for clients who are not regular customers.
oauth: Login to the admin area.
reset_password: Reset the password for storefront customers.
user_recovery: Reset the password for the admin area.
oauth: Login to the admin area.

You may deactivate a function by altering the enabled: true line in the relevant function definition to enabled: false. Within the Shopware, you’ll discover the setting options in the shopware.yaml section. The code will look like this:

shopware:
    api:
       rate_limiter:
            login:
                enabled: true
                policy: 'time_backoff'
                reset: '24 hours' # reset limit after this time if no more requests failed
                limits:
                    - limit: 10
                      interval: '10 seconds'
                    - limit: 15
                      interval: '30 seconds'
                    - limit: 20
                      interval: '60 seconds'
            guest_login:
                enabled: true
                policy: 'time_backoff'
                reset: '24 hours'
                limits:
                    - limit: 10
                      interval: '10 seconds'
                    - limit: 15
                      interval: '30 seconds'
                    - limit: 20
                      interval: '60 seconds'
            oauth:
                enabled: true
                policy: 'time_backoff'
                reset: '24 hours'
                limits:
                    - limit: 10
                      interval: '10 seconds'
                    - limit: 15
                      interval: '30 seconds'
                    - limit: 20
                      interval: '60 seconds'
            reset_password:
                enabled: true
                policy: 'time_backoff'
                reset: '24 hours'
                limits:
                    - limit: 3
                      interval: '30 seconds'
                    - limit: 5
                      interval: '60 seconds'
                    - limit: 10
                      interval: '90 seconds'
            user_recovery:
                enabled: true
                policy: 'time_backoff'
                reset: '24 hours'
                limits:
                    - limit: 3
                      interval: '30 seconds'
                    - limit: 5
                      interval: '60 seconds'
                    - limit: 10
                      interval: '90 seconds'
            contact_form:
                enabled: true
                policy: 'time_backoff'
                reset: '24 hours'
                limits:
                    - limit: 3
                      interval: '30 seconds'
                    - limit: 5
                      interval: '60 seconds'
                    - limit: 10
                      interval: '90 seconds'

Final Words

We hope this tutorial will help you understand how to protect your system from flooding in Shopware. DDoS assaults are getting more widespread, costing billions of dollars in damage. They are also becoming more sophisticated. Because you have no control over the traffic to your site, it is hard to defend yourself against DDoS assaults. However, if you utilize one of the services listed above, avoid using inexpensive hosting, and prepare yourself for a DDoS assault if one occurs, you will be far less likely to be victimized.