Drupal Perimeter Defence

Basic perimeter defence for a Drupal site. This module bans the IPs who send suspicious requests to the site. The concept is: if you have no business here, go away.

Use the perimeter module if you get a lot of requests to 'wp-admin' or to .aspx urls on a linux server, or other similar requests.

Currently, the module bans users who generate "page not found" events for requesting any of the following url patterns:

  private $bannedPatterns = [
    '/.*.aspx/',
    '/.*.asp/',
    '/.*.jsp/',
    '//blog_edit.php/',
    '//blogs.php/',
    '//wp-admin.*/',
    '//wp-login.*/',
    '//my_blogs/',
    '//system/.*.php/',
    '/.*systopice.*/',
  ];

The module is optimized for performance and designed to be activated when a Drupal site is targeted by hackers or bots.

How to use

Just enable the module, and check your site logs after a while.

Use the core's ban module to manage banned IPs.

Note: Before testing this module from your own IP, make sure you can delete your IP from the ban_ip table in your Drupal site's database.

Future improvements

• Make url patterns configurable.
• Respond to other events, like honeypot failures or invalid login attempts.