IIS 7 The service is unavailable.

Recently noobs been going around attacking sites with xml-rpc. I know most hotels uses CloudFlare "I'm under attack" mode to stop the attack. That worked but it'll also slow down your site such as users/furnitures not loaded every few minutes because of the 5secs CloudFlare check. I'm wondering if theres any other way to stop the attack? I've tried IIS module Dynamic IP Restriction and using web.config to block the wordpress useragent but don't seem to work.

http://prntscr.com/4wbkrh

The Dynamic IP Restriction should definitely solve this issue. Have you tried configuring it to the bare minimum? (Accepting only 1 request per IP, every 0.1 seconds or something)

Double click this in IIS Manager



Then Double click FastCGI settings






Now go in there right click php-cgi.exe and click "Edit"





Once your in the edit section Change "Queue Length" from 1000 to 100000000




Once you have done this you shouldn't receive the "The service is unavailable." Error.

Hope this helps!