I have gone through each of the answers here, updated the ini files, apache files, nginx files, timeouts still keep happening. I am not even sure where it is hitting, as the error logs have these repetitively:
[Sun Nov 23 16:16:13.228212 2025] [proxy_fcgi:error] [pid 7163:tid 7166] (70007)The timeout specified has expired: [client 202.76.186.78:0] AH01075: Error dispatching request to : (polling)
& now these errors:
[Sun Nov 23 17:04:54.050701 2025] [mpm_event:error] [pid 5908:tid 5908] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit.
I will try for few hours. Trouble is, seems some rouge bots are continuously kicking in. Or someone has fed my engine up with rss or something. This is a search engine, which caused all other sites to stop working.
It was not like this till 18 hours ago.
Also, if it comes back as an issue, what can I do?
I can see few IPs, but am not sure if those are really bots or not. I will keep a watch for 1 or 2 days max, & will have to start blocking. I realize, it really is time consuming to maintain own server. It has its ups & down.
[Mon Nov 24 15:18:05.789323 2025] [mpm_event:error] [pid 16897:tid 16897] AH10159: server is within MinSpareThreads of MaxRequestWorkers, consider raising the MaxRequestWorkers setting
[Mon Nov 24 15:18:12.797190 2025] [mpm_event:error] [pid 16897:tid 16897] AH00484: server reached MaxRequestWorkers setting, consider raising the MaxRequestWorkers setting
Since the last hour or so. The IP ranges are varying.
Some like:
202.76.169.7 / 146.174.181.94
All are 202.76.x.x & 146.174.x.x
Last 5000 lines. So these seem to be bot, but I am not sure how I can identify if they indeed are bot? The are continuously hitting /images & /videos.
42277 in the list of hits, same IPs. will block them, I guess.
Both ranges are from Singapore (Huawei Clouds), and there is no legitimate reason to make 5000 requests in less than an hour. So it looks like a DDoS attack, maybe some bots scraping your site, trying to bring it down, etc. but it definitely doesn’t look like legitimate traffic. I would block both ranges: 202.76.160.0/20 and 146.174.176.0/20, at least for a while.