How to time out bots crawling website (pages do not exist)
Every day I get lots of bots crawling my website for pages like ...cjfuns.php, ...wp-head.php, ...my1.php etc. I assume they are searching for wordpress vulnerabilities (I do not use wordress).
I was wondering if there is a way I can automatically time out IP addresses if they search for a file that does not exist? Is this something I can do with cloudflare, or is it better to do it on the server directly?
Thanks!
2 Replies
The only way you'll do that on Cloudflare is with Advanced Rate Limiting, which is only available as part of an Enterprise plan with a paid addon - https://developers.cloudflare.com/waf/rate-limiting-rules/#availability
it would be best to implement this on your server, or create a set of static rules for paths that you want to block requests for and add those to a Custom Rule https://developers.cloudflare.com/waf/custom-rules/
thanks