A few days ago, this small blog was constantly targeted and attacked by a certain expert in a group chat. Since I had enabled a CDN, the attacker could not obtain my origin IP, so they instead launched a large-scale CC attack against my website, catching me completely off guard.
Because there were too many IP addresses involved in the attack, manually blacklisting them was almost impossible. I happened to remember Baidu Cloud Acceleration's intelligent CC protection feature, which is based on the principle of the five-second shield. I used PHP to simulate Baidu Cloud Acceleration's CC protection mechanism and wrote a simple protection script, which I am sharing with everyone today.
PHP Anti-CC Code
<?php
define('SYSTEM_ROOT', dirname(preg_replace('@\\(.*\\(.*$@', '', preg_replace('@\\(.*\\(.*$@', '', __FILE__))) . '/');
session_start();
date_default_timezone_set('Asia/Shanghai');
header('Content-Type: text/html; charset=UTF-8');
function getspider($useragent = '') {
if (defined('CC_Defender') && CC_Defender == 2) return false;
if (!$useragent) {
$useragent = $_SERVER['HTTP_USER_AGENT'];
}
$useragent = strtolower($useragent);
$spiders = [
'baiduspider', 'googlebot', 'soso', 'bing', 'yahoo', 'sohu-search',
'sogou', 'youdaobot', 'yodaobot', 'robozilla', 'msnbot', 'lycos',
'ia_archiver', 'archive.org_bot', 'sitebot', 'mj12bot', 'gosospider',
'gigabot', 'yrspider', 'jikespider', 'addsugarspiderbot', 'testspider',
'etaospider', 'wangidspider', 'foxspider', 'docomo', 'yandexbot',
'ezooms', 'sinaweibobot', 'catchbot', 'surveybot', 'dotbot', 'purebot',
'ccbot', 'mlbot', 'adsbot-google', 'ahrefsbot', 'spbot', 'augustbot'
];
foreach ($spiders as $spider) {
if (strpos($useragent, $spider) !== false) return $spider;
}
return false;
}
if ($_GET['rand'] && $_SESSION['rand_session'] != $_GET['rand']) {
header('Content-Type: text/html; charset=UTF-8');
exit('<b>浏览器不支持 COOKIE 或访问异常！</b>');
}
if (!$_SESSION['rand_session']) {
if (!getspider()) {
$rand_session = md5(uniqid() . rand(1, 1000));
$_SESSION['rand_session'] = $rand_session;
exit("<!DOCTYPE HTML>
<html>
<head>
<meta charset=\"UTF-8\"/>
<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1\" />
<title>安全检查中...</title>
<script>
var i = 5;
var intervalid;
intervalid = setInterval(\"fun()\", 1000);
function fun() {
if (i == 0) {
window.location.href = \"?{$_SERVER['QUERY_STRING']}&rand={$rand_session}\";
clearInterval(intervalid);
}
document.getElementById(\"mes\").innerHTML = i;
i--;
}
</script>
<style>
html, body {width: 100%; height: 100%; margin: 0; padding: 0;}
body {background-color: #ffffff; font-family: Helvetica, Arial, sans-serif; font-size: 100%;}
h1 {font-size: 1.5em; color: #404040; text-align: center;}
p {font-size: 1em; color: #404040; text-align: center; margin: 10px 0 0 0;}
#spinner {margin: 0 auto 30px auto; display: block;}
.attribution {margin-top: 20px;}
</style>
</head>
<body>
<table width=\"100%\" height=\"100%\" cellpadding=\"20\">
<tr>
<td align=\"center\" valign=\"middle\">
<noscript><h2>请开启浏览器的 JavaScript 功能并刷新页面</h2></noscript>
<h1><span>浏览器安全检查中...</span></h1>
<p>该过程自动完成</p>
<p>请稍候，还剩 <span id=\"mes\">5</span> 秒</p>
</td></tr></table>
</body></html>");
}
}
?>
Add the above PHP code to the PHP file at the beginning of your website (such as index.php or another main entry file) to enable protection. This way, only browsers that pass the security verification and obtain a COOKIE can access your website normally.
Notes
- This method is only suitable for relatively small-scale attacks, such as ordinary CC attacks.
- If you encounter a large-scale distributed botnet attack, such as a DDoS attack, this code may be powerless. It is recommended to use a professional anti-DDoS service.
- When attacked, remain discreet and handle the situation calmly; avoid provocation.