SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today i have facing a problem of the Denial of Service (DoS) attacks on my public facing anonymous web site.

My server return the error message as "Server is too busy, Try again later".

We have firewall as well, But we dont block the IP's coz its dynamic all over the world.

Please guide me how we can prevent this attack. Or is there any way to avoid this kind of attack from the sharepoint or from the code

Any suggestion will be appreciated.

share|improve this question
Now my observational is below. When i investigate the request through the Worker process...I identify the huge no of page request comes for various pages. And thats the reason my w3wp.exe service utilise the 99% CPU. Also the sharepoint has the threshhold. If w3wp.exe process goes up to that limit then server returns the error "Server is too busy, Try again later." Now we put the offline HTML file to the root directory of my site then w3wp.exe release the CPU utilisation – Optimus May 9 '12 at 5:35
Now i am thinking to develop the similar thing in the .net where we will create some HTML page & costume HTTP handler which will redirect user to that HTML page. Where user has to click on the continue link manually and then request will come to our sharepoint site. – Optimus May 9 '12 at 5:40
I am assuming the every request which will comes from the attacker will redirected to the HTML and end stay on the page will not redirected to sharepoint site. Only the genuine user will click on the Continue link and redirected to SharePoint site. This way we can reduce the process of w3wp.exe and our site will be live. Please advice me is this correct thinking or wrong.... Thanks in advance .... – Optimus May 9 '12 at 5:40

Honestly, Denial of Service are better (and must be) handled at levels below SharePoint i.e. ASP.NET, IIS, OS or infrastructure levels. Being an application stack, SharePoint would have no or limited tools to prevent such attacks. Also, trying to handle it at SharePoint level would prove inefficient.

I would recommend posting the question in ASP.NET/IIS forum.

As a side note, I know some Hosting companies even offer tools/service to detect and eliminate such threats.

share|improve this answer

As Ashish states its not really going to be at the SharePoint level. In most situations you would put something in front of SharePoint, just like you would any other web application. There are many utilites out there but when it comes to Microsoft maybe some of the Forefront technologies may help with what you are trying to handle. Something else to consider is what information or services you are exposing on your public facing site. For instance are you using forms services and doing any workflows based on impersonation. If so that is a bad idea and really does open you up to programmatic types of attacks.

share|improve this answer
Thanks for replying quickly..... – Optimus May 9 '12 at 5:02

I think we can't PREVENT Denial of Service (DOS), however we can REDUCE unauthorized packages from attacker by packet filter mechanism, or IP restriction (for small attack)( For large attack, You can use hardware firewall such as Juniper, Cisco, Astaro...those hardware firewall help you audit and analyze in terms of layers in the OSI model. (You can refer to this video:

If an attack aims to SQL Server through port 1433, you should consider changing default port by a specific port and then make sure your firewall allows that specfic port.

I don't kinda believe software firewall, but if because of limited budget, you can consider some software products like Astaro, Forefront....

One thing you can implement to reduce DOS package is to build failover clustering functionality for web application, or NLB with DFS/DFS-R as well.

In a nutshell, there are many ways to REDUCE Dos but you have to have basic understanding of system mechanism, as well as skills of hacking/security prior to making your SharePoint more safely.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.