Bloquear bots con Cloudflare (Custom WAF Rule)

Tiempo de lectura: < 1 minuto

En tus webs es muy habitual recibir análisis de bots bastante agresivos.

Hoy vamos a aprender cómo añadir reglas en CloudFlare para lograr que no entren muchos de ellos.

Qué hace esta regla

Esta expresión bloquea:

• Bots que escanean rutas típicas:
  • /wp-, /admin, /phpmyadmin, /jenkins, etc.
• Paneles expuestos
• Endpoints de debug (Spring, Laravel, Symfony, etc.)
• APIs internas expuestas accidentalmente
• Archivos sensibles (.env, .sql, .zip, backups…)
• Rutas de exploits conocidos
• Requests raros tipo cgi-bin, CFIDE, etc.
• Intentos de enumeración de servidores

Básicamente: mata el 90% del bot scraping / vuln scanners básicos

PASO 1: Entrar en Cloudflare

Ve a https://dash.cloudflare.com

Selecciona tu dominio

PASO 2: Ir al WAF

Depende del panel:

Nuevo panel Cloudflare:

• Security → Scurity Rules → Create Rule → Custom Rule

Panel antiguo:

• Security → Firewall Rules → Create a Firewall Rule

Nombre: Block bot scanning paths

En el Expression Editor, pega exactamente esto:

(
  (http.request.uri.path matches "(?i)^/wp-")
  or (http.request.uri.path matches "(?i)^/(administrator|adminer|autodiscover|confluence|drupal|ecp|grafana|jenkins|kibana|nifi|owa|phpmyadmin|pma|solr|sites/default|user/login|wiki|webmin|plesk|cpanel|horizon|telescope|myadmin)(/|$)")
  or (http.request.uri.path matches "(?i)^/(cgi-bin|cgi-bin2|cgi-mod|cgi-sys|scgi-bin)(/|$)")
  or (http.request.uri.path matches "(?i)^/(webjars/swagger-ui|swagger|api-docs|openapi)(/|$)")
  or (http.request.uri.path matches "(?i)^/(actuator|management|heapdump|threaddump|jolokia|server-status|server-info|env|beans|metrics|health/*)(/|$)")
  or (http.request.uri.path matches "(?i)^/(_profiler|_debugbar|_ignition|debug|telescope)(/|$)")
  or (http.request.uri.path matches "(?i)^/(jmx-console|web-console|manager/html|invoker)(/|$)")
  or (http.request.uri.path matches "(?i)^/(elasticsearch|_cat|_nodes|_cluster|couchdb|redis|mongo)(/|$)")
  or (http.request.uri.path contains "+CSCOT+")
  or (http.request.uri.path contains "+CSCOE+")
  or (http.request.uri.path matches "(?i)^/CFIDE(/|$)")
  or (http.request.uri.path matches "^/\\.[^/]" and not http.request.uri.path matches "^/\\.well-known(/|$)")
  or (http.request.uri.path matches "(?i)phpunit")
  or (http.request.uri.path matches "(?i)(c99|r57|alfa|b374k|wso|indoxploit)")
  or (http.request.uri.path matches "(?i)\\.(aspx?|jsp|do|action|cgi|pl|cfm|shtml)($|[/?])")
  or (http.request.uri.path matches "(?i)\\.(key|pem|sql|sh|yml|yaml|bak|swp|swo|tar|zip|gz|log|inc|dump|old|rar)$")
  or (http.request.uri.path matches "(?i)(^|/)(composer\\.(json|lock)|package\\.json|docker-compose\\.yml|Dockerfile|Jenkinsfile|secrets\\.yml|\\.env\\..*|database\\.yml|credentials|local_settings)($|[./])")
  or (http.request.uri.path matches "(?i)\\.php($|[/?])" and not http.request.uri.path matches "(?i)^/index\\.php($|[/?])")
)
and not cf.client.bot

Acción: Block

Place: First