# Preventing DDoS on a Discourse instance?
**URL:** https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348
**Category:** Support
**Created:** [November 13, 2019, 11:24pm UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348 "2019-11-13T23:24:03Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@chi\_noti\_info](https://meta.discourse.org/u/chi_noti_info)
#### Post date: [November 13, 2019, 11:24pm UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/1 "2019-11-13T23:24:03Z")
Hello.
I had a discourse forum which got ddos’d to hell last month (it’s basically a community about news, and what got me ddos’d was the posting of news about ecuadorean protests a month ago. Real eyeopener too). Anyway, this is basically a “hobby” of mine and I don’t really have the money to pay for expert help or expensive servers. It’s just a rather cheap standard vps dedicated exclusively to discourse.
So, what are some good tips you could give me to harden the security of my dirscourse?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 13, 2019, 11:47pm UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/2 "2019-11-13T23:47:24Z")
Configure UFW and if necessary put it behind Cloudflare with a page rule to “disable performance” so that it doesn’t screw around with the code.
---
### Author:  [@chi\_noti\_info](https://meta.discourse.org/u/chi_noti_info)
#### Post date: [November 14, 2019, 1:05am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/3 "2019-11-14T01:05:01Z")
Thank you. Can you elaborate on both ideas?
1)What would be a good configuration for ufw with discourse? should i allow port 80 as well or only 224?
2)What would that page rule look like?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 16, 2019, 3:32am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/4 "2019-11-16T03:32:48Z")
This is the one good use case for Cloudflare. But you have to be unbelievably careful that you don’t leak the IP address because if you do it is game over.
---
### Author:  [@Jay91](https://meta.discourse.org/u/Jay91)
#### Post date: [November 16, 2019, 10:18am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/5 "2019-11-16T10:18:15Z")
> [@Stephen](#):
>
> put it behind Cloudflare with a page rule to “disable performance” so that it doesn’t screw around with the code.
So in this case the cloud icon can be turned orange right ? If the performance disabled by page rules ?
---
### Author:  [@chi\_noti\_info](https://meta.discourse.org/u/chi_noti_info)
#### Post date: [November 18, 2019, 4:47am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/6 "2019-11-18T04:47:58Z")
That means using cloudflare for “everything” in the forum, so to speak?.
I have cloudlfare in almost standard configuration and works fine. However some posts here recommend “enable this, disable that”, shich makes me fear exactly that: leaking ip.
I disabled “rocket” something and “minification” on cloudflare, that’s basically it. Am I ok?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 18, 2019, 5:27am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/7 "2019-11-18T05:27:57Z")
Create a page rule which looks like this:
[ ](https://global.discourse-cdn.com/meta/original/3X/a/6/a6c869b853fb2765a8fd9d6df72b939b4d284d72.png)
That will disable everything that can tamper with the code today, and in the future.
If you want to create a caching rule for /uploads/ to save some server transfer that’s fine too.
---
### Author:  [@ckshen](https://meta.discourse.org/u/ckshen)
#### Post date: [March 14, 2022, 3:23am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/8 "2022-03-14T03:23:47Z")
> [@codinghorror](#):
>
> But you have to be unbelievably careful that you don’t leak the IP address because if you do it is game over.
Beyond what @Stephen mentioned above, do I need to do anything else to prevent leaking of IP?
---
### Author:  [@HAWK](https://meta.discourse.org/u/HAWK)
#### Post date: [March 14, 2022, 3:28am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/9 "2022-03-14T03:28:26Z")
There are a few more recent topics that cover this.
> [@How to protect a server's IP from being exposed?](https://meta.discourse.org/t/how-to-protect-a-servers-ip-from-being-exposed/217424):
>
> My forum has CloudFlare and when inserting a URL from this service, I can get the real IP of my server, this is a big gift for DDoS attacks. I checked it on the Discourse Meta and this forum don’t have URL-filtration too. Blocked domain by IPlogger can’t help because the attacker can use a custom domain using the script for logger ip address. I think need use whitelist to filter domain who can use onebox. Example: if admin allow only url from Youtube, Twitter, Imgur, all other ur…
---
### Author:  [@ckshen](https://meta.discourse.org/u/ckshen)
#### Post date: [March 14, 2022, 4:17am UTC](https://meta.discourse.org/t/preventing-ddos-on-a-discourse-instance/133348/10 "2022-03-14T04:17:39Z")
Without going through a service like Cloudflare, I presume Discourse out of the box doesn’t leak IP in any way?