Pro tip: add a Cloudflare WAF rule to block common scanner paths like .env, .git, wp-login they get blocked at the edge and never touch your server

here's the full list of paths I'm blocking feel free to grab it 👇

Better still you can 302 redirect them to these very large files. Script kiddies will really appreciate that

haha, this sounds brutal ... the 10GB bin, lol :D

The Managed Rulesets already block most of these requests, and tools like allow you to block the remaining requests

nice, didn't know about flarehawk

you can copy and insert this into the expression box: there are some paths related to laravel, ask claude to extend this for your framework if you want

nice, this list covers lots of scanners. thanks for sharing!

40% is actually really good for early-stage rate limiting. most people don't add any and wonder why their login endpoints get hammered. what are you using, fail2ban or something custom?

yeah cloudflare + fail2ban with custom rules

switch it to "matches regex" and use this /(\.php|wp-|[/.]env|\.git|\.vscode|\.idea|\.ds_store|\.ht(access|passwd)|pma|phpmyadmin|config|setup|install|cgi-bin|etc\/passwd|proc\/self|actuator|jolokia|heapdump|\.aws\/|\.ssh\/|xmlrpc)/i less clicking and wider coverage

I can't block .php completely... it's a php app :D but good alternative as well, thanks for sharing!

@Igloczek Do your URIs actually include .php? I don’t think they do, since your project isn’t built with pure PHP. The routes are clear without .php, so blocking it shouldn’t cause any issues.

@Igloczek yeah, you're right but I don't want to block .php just in case, so it may cause some other issues Maybe I can test on a different app, but for production I'm afraid to block them all :D

this plus auto-ban is the real combo. i ban any IP that triggers 20+ blocked paths per minute. the scanner traffic drops to basically zero

yes, I applied the same rules 20+ scans for 1 minute -> fail2ban for 1 day + Cloudflare WAF block it's very effective

Hey, it will be very helpful if you could add these texts rules to a gist

good idea, here you go

I also wonder why Cloudflare doesn't do this by default.

yeah, it would be very helpful, if you can just toggle this by default :D

Would just safe a bunch of 404 requests so not that big of a deal imho

but still hitting your web server, I don't want this

Most of these are setup by default

where?

Docs

sure

I use it on all my sites. It significantly reduces bandwidth usage and makes your site more secure.

yeah and also the load on the server. I've added it yesterday and blocks like crazy

this plus rate-limiting on login endpoints. cloudflare catches scanner noise but people forget that their /login is hammered just as much. add a turnstile and watch the abuse drop off a cliff

yep, already done that and blocks 40% of the login requests.

Great tip, straight to the point and useful. Thank you

you're welcom, glad it's helpful

Can I do this on @BunnyCDN as well?

@BunnyCDN I'm not familiar with their UI, but if they have a WAF, yeah you can do it

Gem!

thank you

ELI5?

bots always scan your site for files like .env, .git, wp-login etc trying to find vulnerabilities add a cloudflare firewall rule to block these paths and they get stopped at the edge before they ever reach your server make sense now?

Thank you, is this deployable for CloudFlare Zero Trust Firewall Policies or just for site?

I've added it to the WAF rules, but maybe it will work with Zero Trust... hadn't test it

WordPress Login as well?

oh, that's cool, thatns for the reminder

Thanks for sharing, Venelin!

welcome, Shefali... hope it's helpful :-)

smart will do it tomorrow thanks

Wow great. Thank you!

Thanks, that's great advice.

you're welcom, glad it's helpful

What if someone doesn't want to use cloudflare and configure these things on their own VPS like Hetzner, Ovhclould or any platform which has no built-in setup. Is there any way to prevent scanning there too like configuration of nginx or what to add these security?

yes, fail2ban with custom rules example: 3 of these requests in 1 minute, then ban the IP for 1 day you can configure and adjust

Ok, will try 👍

Thank you so much, I got approximately thousands requests like this everyday, crazy that CF by default not blocking them

yeah same here, that's why I added these rules

managed rules already do this, just enable them brah

which rule does the same?

You blocking core WP paths?

yes, because my app is not WP

Gotcha 👌

Plus Plus captcha or turnstile ✅

yep, turstile is mandatory

cloudflare should just add this by default..

yes!

Is this on the free version or on the paid version?

free version... you have 5 rules

thanks for the tip

welcome, glad it's helpful

I don't think this is needed. You shouldn't make those public in the first place, not even accidentally.

@sanchogodinho why?

If they expose basic stuff like this, they most probably don't know to write secure code. Most big companies don't really use WAF to block these routes.

@sanchogodinho haha ok... but I'm not a big company... solo dev here this is helpful and I want to share it, ok? :D

damn cool, i'll copy your gist in CF WAF thanks Ven. :)

you're welcome mate, hope it helps!

For non WordPress site

yep

Basic tip

but it works :D

Thanks a lot. My webservers only accept cloudflare reverse proxy requests. This will harden it even more ✊🏼

💯