How a Malicious Bot Attack Forced Me to Rebuild My Webmaster Tools on Edge Computing

Hey DEV community! 👋

I’m the indie developer behind Site Tools Box, a free suite of 20+ webmaster tools (Dead Link Checker, WHOIS, UTM builder, etc.). We have a simple core philosophy: No intrusive ads, no forced sign-ups, just fast tools.

But last week, I woke up to a nightmare. My server (a humble 2GB RAM machine) was screaming for mercy.

Here is the story of how a malicious bot attack forced me to rethink my entire architecture, offload workloads to the Edge, and build a custom defense system.

🚨 The Incident: The 0-Second Spam Attack

I noticed a massive spike in my traffic logs. At first, I was excited—until I looked closer.

Every single request was hitting my submit page (submit.php). The dwell time was exactly 0 seconds, and the exact same IP (66.227.112.166) was hammering my server every few seconds. It was a brute-force spam attack.

Because my site is built with Vanilla PHP (no heavy frameworks), the server was trying to process every single request, query the database for the "Trending Tools" sidebar, and render the page. My memory limit was hitting the ceiling. I had to act fast.

🛡️ Defense Mechanism 1: The PHP IP Blacklist

I didn't want to mess with complex Nginx configurations or paid firewalls. I wanted a lightweight solution. So, I built a custom IP blacklist system.

I hooked a function into my global functions.php file. Before any database query or page rendering happens, it checks a local JSON file:

// Instant IP Blocking System
function stb_check_ip_block() {
$ip = getClientIp(); // Handles Cloudflare real IP
$blockFile = DIR . '/../data/blocked_ips.json';

if (file_exists($blockFile)) {
    $blocked = json_decode(file_get_contents($blockFile), true);
    if (is_array($blocked) && in_array($ip, $blocked)) {
        header('HTTP/1.1 403 Forbidden');
        die('Your IP has been blocked by the administrator.');
    }
}

}
stb_check_ip_block();

Now, I have a simple admin dashboard where I can paste an IP, click "Block", and they are instantly denied access at the very first layer. The bot is met with a cold 403 Forbidden.

🚀 Defense Mechanism 2: Moving the Heavy Lifting to the Edge

The attack made me realize something: my server should not be doing heavy network requests.

My most popular tool is the Dead Link Checker. Originally, a user would input a URL, my PHP server would scrape the page, find up to 300 links, and then curl each one to check its HTTP status.

If 10 users did this at once, my server was making 3,000 concurrent requests. That’s a DDoS on my own server!

So, I moved the heavy lifting to Cloudflare Workers.

Now, my PHP server only scrapes the initial HTML (a single request). The frontend then sends the extracted links to a Cloudflare Worker via fetch().

// Frontend Edge Request (Simplified)
fetch('https://my-worker.workers.dev/?url=' + encodeURIComponent(link))
.then(res => res.json())
.then(data => {
// Worker returns status: 200 or status: 404
updateUI(link, data.status);
});

My Worker script acts as a proxy, checking the links from Cloudflare's global network.

The result?

• My origin server no longer gets blacklisted by target websites.
• The scan is 10x faster because it's distributed across CF edge nodes.
• My 2GB RAM server usage dropped back to a peaceful 20%.

💡 Why I'm Sharing This

Building free tools for the community is incredibly rewarding, but it also makes you a target for bots.

If you are running a lightweight PHP app, you don't need a massive enterprise firewall. A simple JSON blacklist and an Edge proxy can save your sanity (and your server bill).

Our core promise at Site Tools Box hasn't changed: Free tools, no forced sign-ups, no BS. We are just making the infrastructure stronger so you can have a seamless experience.

Have you guys ever dealt with bot spam? How did you handle it? Let me know in the comments! 👇