You often receive aggressive bot analysis on your websites.
Today we are going to learn how to add rules in CloudFlare so that not many of them enter.
What the rule blocks
This expression blocks:
Basically: kills 90% of basic bot scraping / vuln scanners Paso 1: Enter Cloudflare Go to https://dash.cloudflare.com Select your domain Paso 2: Go to the WAF It depends on the panel:
Create the rule in Cloudflare
Name: Block bot scanning paths In the Expression Editor, paste exactly this:
( (http.request.uri.path matches "(?i)^/wp-") or (http.request.uri.path matches "(?i)^/(administrator|adminer|autodiscover|confluence|drupal|ecp|grafana|jenkins|kibana|nifi|owa|phpmyadmin|pma|solr|sites/default|user/login|wiki|webmin|plesk|cpanel|horizon|telescope|myadmin)(/|$)") or (http.request.uri.path matches "(?i)^/(cgi-bin|cgi-bin2|cgi-mod|cgi-sys|scgi-bin)(/|$)") or (http.request.uri.path matches "(?i)^/(webjars/swagger-ui|swagger|api-docs|openapi)(/|$)") or (http.request.uri.path matches "(?i)^/(actuator|management|heapdump|threaddump|jolokia|server-status|server-info|env|beans|metrics|health/*)(/|$)") or (http.request.uri.path matches "(?i)^/(_profiler|_debugbar|_ignition|debug|telescope)(/|$)") or (http.request.uri.path matches "(?i)^/(jmx-console|web-console|manager/html|invoker)(/|$)") or (http.request.uri.path matches "(?i)^/(elasticsearch|_cat|_nodes|_cluster|couchdb|redis|mongo)(/|$)") or (http.request.uri.path contains "+CSCOT+") or (http.request.uri.path contains "+CSCOE+") or (http.request.uri.path matches "(?i)^/CFIDE(/|$)") or (http.request.uri.path matches "^/\\.[^/]" and not http.request.uri.path matches "^/\\.well-known(/|$)") or (http.request.uri.path matches "(?i)phpunit") or (http.request.uri.path matches "(?i)(c99|r57|alfa|b374k|wso|indoxploit)") or (http.request.uri.path matches "(?i)\\.(aspx?|jsp|do|action|cgi|pl|cfm|shtml)($|[/?])") or (http.request.uri.path matches "(?i)\\.(key|pem|sql|sh|yml|yaml|bak|swp|swo|tar|zip|gz|log|inc|dump|old|rar)$") or (http.request.uri.path matches "(?i)(^|/)(composer\\.(json|lock)|package\\.json|docker-compose\\.yml|Dockerfile|Jenkinsfile|secrets\\.yml|\\.env\\..*|database\\.yml|credentials|local_settings)($|[./])") or (http.request.uri.path matches "(?i)\\.php($|[/?])" and not http.request.uri.path matches "(?i)^/index\\.php($|[/?])") ) and not cf.client.bot
Set the action
Action: Block Place: First
