LiteSpeed Web Server includes protection against connection floods, aggressive bots and WordPress login attacks, built into the web server itself. Set sensibly, these features absorb attacks before they reach PHP and the database.
On MdmHost hosting plans this is handled by our team. This guide is for administrators of their own cPanel server with root SSH access.
Before you start
- LiteSpeed Enterprise on cPanel and access to the WebAdmin console (see the WebAdmin console).
- A baseline of normal traffic, so you do not set limits that block real visitors.
Per-client throttling
- In WebAdmin go to Configuration → Server → Security → Per Client Throttling.
- Review Static Requests/Second, Dynamic Requests/Second, Connection Soft Limit and Connection Hard Limit.
- Keep Block Bad Request enabled and set a Banned Period (for example 60 seconds).
- Save and do a graceful restart.
| Setting | Starting point |
|---|---|
| Dynamic Requests/Second | Default, or 10–20 on busy shared servers |
| Connection Soft Limit | Around 15 |
| Connection Hard Limit | Around 30–50 |
| Grace Period | 15 seconds |
Warning: Clients behind a shared IP (offices, mobile carriers, CDNs) make many connections. If you use a CDN, make sure LiteSpeed sees the real visitor IP, otherwise throttling bans the CDN.
Server-level reCAPTCHA
LiteSpeed can show a reCAPTCHA challenge to suspicious clients when the server is under load, instead of passing requests to PHP.
- Go to Configuration → Server → Security → reCAPTCHA Protection.
- Enable it and choose the trigger, for example Trigger Sensitivity based on concurrent connections.
- Leave the site key and secret empty to use LiteSpeed's built-in keys, or enter your own.
- Save and restart gracefully.
Imunify360 WebShield offers similar challenges; if both run, test that visitors are not challenged twice (see WebShield).
WordPress brute-force protection
In Configuration → Server → Security → WordPress Brute Force Attack Protection, LiteSpeed can count POSTs to wp-login.php and xmlrpc.php per IP and throttle, deny or challenge with reCAPTCHA above a threshold. Choose Throttle or CAPTCHA for a balance between security and usability. On cPanel, this setting is also available in the WHM LiteSpeed plugin.
Check it works
- Watch
/usr/local/lsws/logs/error.logfor throttling and ban messages. - In WebAdmin, Real-Time Stats shows connections and requests per virtual host.
- Combine with CloudLinux limits so a single account cannot exhaust the server (see CloudLinux Manager settings).
Troubleshooting
Real users get 403 or banned
Limits are too strict, or the server sees a proxy IP. Raise the limits and configure the real-IP header for your CDN.
Attack continues anyway
Large network-level floods need upstream filtering by the data centre or a CDN; web server limits help with application-level floods.
Frequently asked questions
Does this replace a firewall?
No. It works at the HTTP level. Keep Imunify360 or another firewall for network-level blocking.
Will search engines be throttled?
Normal crawl rates stay well below sensible limits. Very aggressive crawlers may be slowed, which is usually desirable.
Can I exempt my monitoring service?
Yes. Add trusted IPs to the server's allowed list in the security settings so throttling and reCAPTCHA never apply to them.