Our school web site gets attacked all the time. It has been an exercise in learning how to defend against wordpress attacks. The principal defense is when I get a notification that the site is under attack, I add an entry to block the offending IP in my httpd.conf file.

GeoIPEnable On
SetEnvIf GEOIP_COUNTRY_CODE SK BlockCountry
Deny from env=BlockCountry
Deny from xxx.xxx.xxx.xxx

However, it doesn't stop the attack traffic, just denies the attempt via 403 notice. The server is still spending resources bouncing the traffic. High availability and resiliency is not an organizational priority for this website, I just need to be able to bring it back if it goes down. However, I do not like it when bad guys bang my site.

I figure that VPC NACLs would be useful, since I can drop offending traffic at the network layer and not worry my webserver instance. Pretty cool, right?

Not so much. There is a 20 rule limit (20 for ingress, 20 for egress) per NACL, so it is great for squelching subnets or immediate attacks, but not for a long list of attackers. I guess I'll have to play with setting up a WAF after all.