← News
/PLAYBOOK · 2026-09-11

Why CC Attacks Target Dynamic Pages — and How to Defend Effectively

Why do CC attacks hit dynamic pages? Target-selection logic and typical symptoms, plus practical defenses: Nginx path-precise rate limits, cache strategy, database backstops, and staged captcha.

Many operators' first move is "CDN cache and we're fine." CC attacks skip cache and hit login, search, and submit—CPU spikes, DB pool saturates, pages still die. Q&A on CC target-selection logic, typical symptoms on dynamic pages, and a full defense: Nginx precise rate limits, cache strategy, database backstop.

Why Do CC Attacks Target Dynamic Pages?

Cost-vs-effect asymmetry: static requests get absorbed by CDN cache—10,000 hits may origin a handful of times. Each dynamic request runs scripts, hits the database, writes logs. One attacker request costs the server ~100x the resources. CC is max resource burn per unit traffic. Dynamic pages are the highest-ROI target.

Which Dynamic Endpoints Do Attackers Pick?

Self-check: mine access.log for parameterized URLs with abnormal volume—attackers look at the same thing.

Typical Symptoms When Dynamic Pages Are Under CC

Signature combo: low bandwidth + high CPU + slow queries + URL concentration ≈ CC.

How to Rate-Limit Dynamic Paths in Nginx

Don't blanket the whole site. Valve dynamic entry points precisely:

# define two rate-limit zones in the http block
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
limit_req_zone $binary_remote_addr zone=dynamic:10m rate=10r/s;

# login endpoint: max 5 requests per IP per minute
location = /wp-login.php {
    limit_req zone=login burst=3 nodelay;
    limit_req_status 429;
    include fastcgi_params;
    fastcgi_pass unix:/tmp/php-cgi.sock;
}

# other dynamic requests: 10 per second, burst tolerance 20
location ~ \.php$ {
    limit_req zone=dynamic burst=20 nodelay;
    limit_req_status 429;
}

rate and burst must track real business peaks: measure actual login-page frequency from logs, set threshold at 2–3x normal peak. Too tight false-positives. Pair with `limit_conn` for per-IP concurrent connections.

What Role Does Cache Play?

Strategic value: cut dynamic requests that must origin.

Set sane invalidation. Under attack, attack traffic can stampede the cache and hit rate goes to zero.

Database Backstop

If upstream leaks through, keep the DB alive:

# MySQL: limit max connections and single-query timeout
set global max_connections = 200;
set global max_execution_time = 3000;  -- milliseconds, SELECT timeout

# php-fpm: limit process count to prevent request pile-up exhausting memory (www.conf)
pm.max_children = 30
pm.max_requests = 500

Add slow-query log (`long_query_time = 1`). During CC, watch which queries fire repeatedly; add indexes or cache.

When to Use Captcha and JS Challenges

Additional Recommendations