SWS Holocron

Cloudflare Firewall

Block lists

Copy of the latest rule lists made for blocking, to add them:

Naming Scheme: RULE-VERSION-DATE

Creating a new firewall rule

  1. Go to security -> WAF
  2. Click to create new firewall rule
  3. Add the specific name of the rule list into the Rule name (required) box
  4. Click edit expression under the ” When incoming requests match… ” section
  5. Copy and paste the latest expression from here

Updating an existing firewall rule

  1. Go to security -> WAF
  2. Click the spanner for which rule you would like to update
  3. Scroll down and click edit expression
  4. Delete the existing expression
  5. Copy and paste the latest expression from here

sws-agent - This is our user agent blocking list

This ruleset is for trying to block user-agents only, rule name in Cloudflare:

sws-agent

Changelog

added – to block

added Go-http-client to block

Removes all the URI bits to move to the sws-uri ruleset

Removes Apache-HttpClient user agent from the list as it was found to block Linkedin

Expression ( Rule sets )

V11 - 10/10/2024

				
					(http.user_agent contains "Presto/2.9.181 Version/12.00") or (http.user_agent contains "ZoominfoBot") or (http.user_agent contains "SearchAtlas.com SEO Crawler") or (http.user_agent contains "http://mj12bot.com/") or (http.user_agent contains "python-requests") or (http.referer contains "http://site.ru") or (http.user_agent contains "http://datasift.com/bot.html") or (http.user_agent contains "Crawler4j") or (http.user_agent contains "http://spaziodati.eu/") or (http.user_agent contains "http://webmeup-crawler.com/") or (http.user_agent contains "http://www.opensiteexplorer.org") or (http.user_agent contains "http://ahrefs.com/robot/") or (http.user_agent contains "https://app.hypefactors.com") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "http://www.brandwatch.net") or (http.user_agent contains "http://www.wise-guys.nl/") or (http.user_agent contains "PetalBot") or (http.user_agent contains "SerendeputyBot") or (http.user_agent contains "Bytespider; spider-feedback@bytedance.com") or (http.user_agent contains "https://developer.amazon.com/support/amazonbot") or (http.referer contains "news.grets.store") or (http.referer contains "static.seders.website") or (http.referer contains "rida.tokyo") or (http.referer contains "info.seders.website") or (http.referer contains "trast.mantero.online") or (http.referer contains "kar.razas.site") or (http.referer contains "game.fertuk.site") or (http.referer contains "ofer.bartikus.site") or (http.referer contains "garold.dertus.site") or (http.referer contains "phmg.lightning.force.com") or (http.user_agent contains "Go-http-client") or (http.user_agent eq "-")

V10 - 01/10/2024

				
					(http.user_agent contains "Presto/2.9.181 Version/12.00") or (http.user_agent contains "ZoominfoBot") or (http.user_agent contains "SearchAtlas.com SEO Crawler") or (http.user_agent contains "http://mj12bot.com/") or (http.user_agent contains "python-requests") or (http.referer contains "http://site.ru") or (http.user_agent contains "http://datasift.com/bot.html") or (http.user_agent contains "Crawler4j") or (http.user_agent contains "http://spaziodati.eu/") or (http.user_agent contains "http://webmeup-crawler.com/") or (http.user_agent contains "http://www.opensiteexplorer.org") or (http.user_agent contains "http://ahrefs.com/robot/") or (http.user_agent contains "https://app.hypefactors.com") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "http://www.brandwatch.net") or (http.user_agent contains "http://www.wise-guys.nl/") or (http.user_agent contains "PetalBot") or (http.user_agent contains "SerendeputyBot") or (http.user_agent contains "Bytespider; spider-feedback@bytedance.com") or (http.user_agent contains "https://developer.amazon.com/support/amazonbot") or (http.referer contains "news.grets.store") or (http.referer contains "static.seders.website") or (http.referer contains "rida.tokyo") or (http.referer contains "info.seders.website") or (http.referer contains "trast.mantero.online") or (http.referer contains "kar.razas.site") or (http.referer contains "game.fertuk.site") or (http.referer contains "ofer.bartikus.site") or (http.referer contains "garold.dertus.site") or (http.referer contains "phmg.lightning.force.com") or (http.user_agent contains "Go-http-client")

V9.0 - 27/02/2024

				
					(http.user_agent contains "Presto/2.9.181 Version/12.00") or (http.user_agent contains "ZoominfoBot") or (http.user_agent contains "SearchAtlas.com SEO Crawler") or (http.user_agent contains "http://mj12bot.com/") or (http.user_agent contains "python-requests") or (http.referer contains "http://site.ru") or (http.user_agent contains "http://datasift.com/bot.html") or (http.user_agent contains "Crawler4j") or (http.user_agent contains "http://spaziodati.eu/") or (http.user_agent contains "http://webmeup-crawler.com/") or (http.user_agent contains "http://www.opensiteexplorer.org") or (http.user_agent contains "http://ahrefs.com/robot/") or (http.user_agent contains "https://app.hypefactors.com") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "http://www.brandwatch.net") or (http.user_agent contains "http://www.wise-guys.nl/") or (http.user_agent contains "PetalBot") or (http.user_agent contains "SerendeputyBot") or (http.user_agent contains "Bytespider; spider-feedback@bytedance.com") or (http.user_agent contains "https://developer.amazon.com/support/amazonbot") or (http.referer contains "news.grets.store") or (http.referer contains "static.seders.website") or (http.referer contains "rida.tokyo") or (http.referer contains "info.seders.website") or (http.referer contains "trast.mantero.online") or (http.referer contains "kar.razas.site") or (http.referer contains "game.fertuk.site") or (http.referer contains "ofer.bartikus.site") or (http.referer contains "garold.dertus.site") or (http.referer contains "phmg.lightning.force.com")

V8.0 - 14/11/2022 

				
					(http.user_agent contains "Presto/2.9.181 Version/12.00") or (http.user_agent contains "ZoominfoBot") or (http.user_agent contains "SearchAtlas.com SEO Crawler") or (http.user_agent contains "http://mj12bot.com/") or (http.user_agent contains "python-requests") or (http.referer contains "http://site.ru") or (http.user_agent contains "http://datasift.com/bot.html") or (http.user_agent contains "Crawler4j") or (http.user_agent contains "http://spaziodati.eu/") or (http.user_agent contains "http://webmeup-crawler.com/") or (http.user_agent contains "http://www.opensiteexplorer.org") or (http.user_agent contains "http://ahrefs.com/robot/") or (http.user_agent contains "https://app.hypefactors.com") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "http://www.brandwatch.net") or (http.user_agent contains "http://www.wise-guys.nl/") or (http.user_agent contains "PetalBot") or (http.user_agent contains "SerendeputyBot") or (http.user_agent contains "Bytespider; spider-feedback@bytedance.com") or (http.user_agent contains "https://developer.amazon.com/support/amazonbot")

V7.0 - 27/07/2022 

				
					(http.user_agent contains "Presto/2.9.181 Version/12.00") or (http.user_agent contains "ZoominfoBot") or (http.user_agent contains "SearchAtlas.com SEO Crawler") or (http.user_agent contains "http://mj12bot.com/") or (http.user_agent contains "python-requests") or (http.referer contains "http://site.ru") or (http.user_agent contains "http://datasift.com/bot.html") or (http.user_agent contains "Crawler4j") or (http.user_agent contains "http://spaziodati.eu/") or (http.user_agent contains "http://webmeup-crawler.com/") or (http.user_agent contains "http://www.opensiteexplorer.org") or (http.user_agent contains "http://ahrefs.com/robot/") or (http.user_agent contains "https://app.hypefactors.com") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "http://www.brandwatch.net") or (http.user_agent contains "http://www.wise-guys.nl/")

Old - formats wrong

(http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests”) or (http.referer contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.user_agent contains “http://webmeup-crawler.com/”) or (http.user_agent contains “http://www.opensiteexplorer.org”) or (http.user_agent contains “http://ahrefs.com/robot/”) or (http.user_agent contains “https://app.hypefactors.com”) or (http.user_agent contains “SemrushBot”) or (http.user_agent contains “http://www.brandwatch.net”) or (http.user_agent contains “http://www.wise-guys.nl/”) 1111111111111 (http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests”) or (http.referer contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.user_agent contains “http://webmeup-crawler.com/”) or (http.user_agent contains “http://www.opensiteexplorer.org”) or (http.user_agent contains “http://ahrefs.com/robot/”) or (http.user_agent contains “https://app.hypefactors.com”) or (http.user_agent contains “SemrushBot”) or (http.user_agent contains “http://www.brandwatch.net”) or (http.user_agent contains “http://www.wise-guys.nl/”)

(http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests”) or (http.referer contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.request.uri contains “autodiscover.xml”) or (http.user_agent contains “http://webmeup-crawler.com/”) or (http.user_agent contains “http://www.opensiteexplorer.org”) or (http.user_agent contains “http://ahrefs.com/robot/”) or (http.user_agent contains “https://app.hypefactors.com”) or (http.user_agent contains “SemrushBot”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.user_agent contains “http://www.brandwatch.net”) or (http.user_agent contains “http://www.wise-guys.nl/”)

(http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests”) or (http.referer contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.request.uri contains “autodiscover.xml”) or (http.user_agent contains “http://webmeup-crawler.com/”) or (http.user_agent contains “http://www.opensiteexplorer.org”) or (http.user_agent contains “http://ahrefs.com/robot/”) or (http.user_agent contains “https://app.hypefactors.com”) or (http.user_agent contains “SemrushBot”) or (http.request.uri contains “?author=”) or (http.user_agent contains “Apache-HttpClient”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.user_agent contains “http://www.brandwatch.net”) or (http.user_agent contains “http://www.wise-guys.nl/”)

(http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “Site24x7”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests”) or (http.referer contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.request.uri contains “autodiscover.xml”) or (http.user_agent contains “http://webmeup-crawler.com/”) or (http.user_agent contains “http://www.opensiteexplorer.org”) or (http.user_agent contains “http://ahrefs.com/robot/”) or (http.user_agent contains “https://app.hypefactors.com”) or (http.user_agent contains “SemrushBot”) or (http.request.uri contains “?author=”) or (http.user_agent contains “Apache-HttpClient”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.user_agent contains “http://www.brandwatch.net”) or (http.user_agent contains “http://www.wise-guys.nl/”)

(http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “Site24x7”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests”) or (http.referer contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.request.uri.path contains “AutoDiscover/autodiscover.xml”) or (http.user_agent contains “http://webmeup-crawler.com/”) or (http.user_agent contains “http://www.opensiteexplorer.org”) or (http.user_agent contains “http://ahrefs.com/robot/”) or (http.user_agent contains “https://app.hypefactors.com”) or (http.user_agent contains “SemrushBot”) or (http.request.uri.path contains “?author=”) or (http.user_agent contains “Apache-HttpClient”) or (http.request.uri.path contains “phpmyadmin”) or (http.request.uri.path contains “wp-config.php”)

(http.user_agent contains “Presto/2.9.181 Version/12.00”) or (http.user_agent contains “ZoominfoBot”) or (http.user_agent contains “Site24x7”) or (http.user_agent contains “SearchAtlas.com SEO Crawler”) or (http.user_agent contains “http://mj12bot.com/”) or (http.user_agent contains “python-requests/”) or (http.user_agent contains “http://site.ru”) or (http.user_agent contains “http://datasift.com/bot.html”) or (http.user_agent contains “Crawler4j”) or (http.user_agent contains “http://spaziodati.eu/”) or (http.request.uri.path contains “AutoDiscover/autodiscover.xml”)

sws-uri-free - This is our URI blocked list for Cloudflare FREE plans

This ruleset is for trying to block specific URIs or URI patterns, rule name in Cloudflare:

sws-uri-free

Changelog

  1. Added adminer
  2. added readme.txt
  3. added 404.php
  1. initial free build

Expression ( Rule set )

V2 - 09/08/2022

				
					(http.request.uri eq "/404testpage4525d2fdc") or (http.request.uri eq "/wp-content/plugins/wpconfig.bak.php") or (http.request.uri eq "/wp-content/themes/sketch/404.php") or (http.request.uri eq "/404javascript.js") or (http.request.uri eq "/wp_wrong_datlib.php") or (http.request.uri eq "/wikindex.php") or (http.request.uri eq "/1index.php") or (http.request.uri eq "/3index.php") or (http.request.uri eq "/wp-includes/images/css.php") or (http.request.uri eq "/wp-includes/css/css.php") or (http.request.uri eq "/defau1t.php") or (http.request.uri eq "/beence.php") or (http.request.uri contains "export.php") or (http.request.uri eq "/defau11.php") or (http.request.uri eq "/moduless.php") or (http.request.uri contains "xmlrpc.php") or (http.request.uri contains "/wp-content/themes/twenty") or (http.request.uri contains "autodiscover.xml") or (http.request.uri contains "?author=") or (http.request.uri contains "phpmyadmin") or (http.request.uri contains "wp-config.php") or (http.request.uri contains "phpunit") or (http.request.uri contains "leaf.php") or (http.request.uri contains "leafmailer.php") or (http.request.uri contains "fw.php") or (http.request.uri contains "shell.php") or (http.request.uri contains "alfa.php") or (http.request.uri contains "wso.php") or (http.request.uri contains "doc.php") or (http.request.uri contains "adminer") or (http.request.uri contains "404.php") or (http.request.uri contains "readme.txt")

Old - Wrong format

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri eq “/wp-content/themes/sketch/404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri eq “/beence.php”) or (http.request.uri contains “export.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”) or (http.request.uri contains “autodiscover.xml”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.request.uri contains “leaf.php”) or (http.request.uri contains “leafmailer.php”) or (http.request.uri contains “fw.php”) or (http.request.uri contains “shell.php”) or (http.request.uri contains “alfa.php”) or (http.request.uri contains “wso.php”) or (http.request.uri contains “doc.php”) or (http.request.uri contains “adminer”) or (http.request.uri contains “404.php”) or (http.request.uri contains “readme.txt”)

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri eq “/wp-content/themes/sketch/404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri eq “/beence.php”) or (http.request.uri contains “export.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”) or (http.request.uri contains “autodiscover.xml”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.request.uri contains “leaf.php”) or (http.request.uri contains “leafmailer.php”) or (http.request.uri contains “fw.php”) or (http.request.uri contains “shell.php”) or (http.request.uri contains “alfa.php”) or (http.request.uri contains “wso.php”) or (http.request.uri contains “doc.php”)

Known possible issues

If a website is having any issues with exporting its likely down to the export.php file being blocked

sws-uri-pro - This is our URI blocked list

This ruleset is for trying to block specific URIs or URI patterns, rule name in Cloudflare:

sws-uri-pro

Changelog

  1. Added readme.txt regex rule
  2. Added adminer rule
  3. Added /404.php
  1. Added wso.php regex rule
  2. Added doc.php regex rule
  1. Merged the two export.php rules together for optimisation
  2. Added fw.php regex rule
  3. Added alfa.php regex rule

Added URI entries from sws-agent list into this one.

Initial list created

Expression ( Rule set )

V5.0 - 09/08/2022

				
					(http.request.uri eq "/404testpage4525d2fdc") or (http.request.uri eq "/wp-content/plugins/wpconfig.bak.php") or (http.request.uri contains "404.php") or (http.request.uri eq "/404javascript.js") or (http.request.uri eq "/wp_wrong_datlib.php") or (http.request.uri eq "/wikindex.php") or (http.request.uri eq "/1index.php") or (http.request.uri eq "/3index.php") or (http.request.uri matches "^(.*)(LEAF|leaf)(.*)(.php)$") or (http.request.uri eq "/wp-includes/images/css.php") or (http.request.uri eq "/wp-includes/css/css.php") or (http.request.uri eq "/defau1t.php") or (http.request.uri matches "^(.*)(shell|Shell)(.*)(.php)$") or (http.request.uri eq "/beence.php") or (http.request.uri contains "export.php") or (http.request.uri eq "/defau11.php") or (http.request.uri eq "/moduless.php") or (http.request.uri contains "xmlrpc.php") or (http.request.uri contains "/wp-content/themes/twenty") or (http.request.uri contains "autodiscover.xml") or (http.request.uri contains "?author=") or (http.request.uri contains "phpmyadmin") or (http.request.uri contains "wp-config.php") or (http.request.uri contains "phpunit") or (http.request.uri matches "^(.*)(FW|fw)(.*)(.php)$") or (http.request.uri matches "^(.*)(ALFA|alfa)(.*)(.php)$") or (http.request.uri matches "^(.*)(WSO|wso)(.*)(.php)$") or (http.request.uri matches "^(.*)(DOC|doc)(.*)(.php)$") or (http.request.uri matches "^(.*)(README|readme)(.*)(.txt)$") or (http.request.uri contains "adminer")

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri contains “404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri matches “^(.*)(LEAF|leaf)(.*)(.php)$”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri matches “^(.*)(shell|Shell)(.*)(.php)$”) or (http.request.uri eq “/beence.php”) or (http.request.uri contains “export.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”) or (http.request.uri contains “autodiscover.xml”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.request.uri matches “^(.*)(FW|fw)(.*)(.php)$”) or (http.request.uri matches “^(.*)(ALFA|alfa)(.*)(.php)$”) or (http.request.uri matches “^(.*)(WSO|wso)(.*)(.php)$”) or (http.request.uri matches “^(.*)(DOC|doc)(.*)(.php)$”) or (http.request.uri matches “^(.*)(README|readme)(.*)(.txt)$”) or (http.request.uri contains “adminer”)

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri eq “/wp-content/themes/sketch/404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri matches “^(.*)(LEAF|leaf)(.*)(.php)$”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri matches “^(.*)(shell|Shell)(.*)(.php)$”) or (http.request.uri eq “/beence.php”) or (http.request.uri contains “export.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”) or (http.request.uri contains “autodiscover.xml”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.request.uri matches “^(.*)(FW|fw)(.*)(.php)$”) or (http.request.uri matches “^(.*)(ALFA|alfa)(.*)(.php)$”) or (http.request.uri matches “^(.*)(WSO|wso)(.*)(.php)$”) or (http.request.uri matches “^(.*)(DOC|doc)(.*)(.php)$”)

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri eq “/wp-content/themes/sketch/404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri matches “^(.*)(LEAF|leaf)(.*)(.php)$”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri matches “^(.*)(shell|Shell)(.*)(.php)$”) or (http.request.uri eq “/beence.php”) or (http.request.uri contains “export.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”) or (http.request.uri contains “autodiscover.xml”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”) or (http.request.uri matches “^(.*)(FW|fw)(.*)(.php)$”) or (http.request.uri matches “^(.*)(ALFA|alfa)(.*)(.php)$”)

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri eq “/wp-content/themes/sketch/404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri matches “^(.*)(LEAF|leaf)(.*)(.php)$”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri matches “^(.*)(shell|Shell)(.*)(.php)$”) or (http.request.uri eq “/beence.php”) or (http.request.uri eq “/export.php”) or (http.request.uri eq “/wp-content/export.php”) or (http.request.uri eq “/alfa.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”) or (http.request.uri contains “autodiscover.xml”) or (http.request.uri contains “?author=”) or (http.request.uri contains “phpmyadmin”) or (http.request.uri contains “wp-config.php”) or (http.request.uri contains “phpunit”)

(http.request.uri eq “/404testpage4525d2fdc”) or (http.request.uri eq “/wp-content/plugins/wpconfig.bak.php”) or (http.request.uri eq “/wp-content/themes/sketch/404.php”) or (http.request.uri eq “/404javascript.js”) or (http.request.uri eq “/wp_wrong_datlib.php”) or (http.request.uri eq “/wikindex.php”) or (http.request.uri eq “/1index.php”) or (http.request.uri eq “/3index.php”) or (http.request.uri matches “^(.*)(LEAF|leaf)(.*)(.php)$”) or (http.request.uri eq “/wp-includes/images/css.php”) or (http.request.uri eq “/wp-includes/css/css.php”) or (http.request.uri eq “/defau1t.php”) or (http.request.uri matches “^(.*)(shell|Shell)(.*)(.php)$”) or (http.request.uri eq “/beence.php”) or (http.request.uri eq “/export.php”) or (http.request.uri eq “/wp-content/export.php”) or (http.request.uri eq “/alfa.php”) or (http.request.uri eq “/defau11.php”) or (http.request.uri eq “/moduless.php”) or (http.request.uri contains “xmlrpc.php”) or (http.request.uri contains “/wp-content/themes/twenty”)

REGEX notes - NO ESCAPING NEEDED IN CLOUDFLARE 🙂

Examples of blocked URIs:

wp-admin/includes/leafmailer.php.php
wp-admin/css/leaf.php
wp-admin/css/colors/coffee/leafmailer2.8.php
wp-content/plugins/wp-freeform/black2llleaf.php
leaf_php.php
wp-includes/leafmailer2.8.php
wp-admin/maint/leafmailer.php.php

Example of blocked URLs

fw.php
wp-includes/fw.php
wp-admin/css/colors/coffee/fw.php
.well-known/fw.php
wp-admin/maint/fw.php

Example of blocked URLs

my_alfa.php
alfa3.php
alfav4.1-tesla.php
alfa1.php
wp-admin/css/colors/coffee/alfawso.php
wp-includes/alfa.php

Example of blocked URLs

wso.php
wp-content/wso.php
FoxWSOv2.php
wp-admin/css/colors/coffee/wso.php
wso1337.php

Example of blocked URLs

doc.php
wp-content/themes/bigmart/doc.php
wp-content/themes/walmart/doc.php
doc.php/404.php

Example of blocked URLs

wp-content/plugins/ninja-forms/readme.txt
wp-content/plugins/wp-file-manager/readme.txt
wp-content/plugins/iwp-client/readme.txt
wp-content/plugins/kivicare-clinic-management-system/README.txt
wp-content/plugins/the-plus-addons-for-elementor-page-builder/readme.txt
wp-content/plugins/advanced-import/readme.txt
wp-content/plugins/ulisting/readme.txt

Known possible issues

If a website is having any issues with exporting its likely down to the export.php file being blocked

sws-country - This is default countries blocked

This ruleset is for blocking countries that are known to launch DDOS attacks and don’t need access to our websites.

sws-country

Expression ( Rule set )

V2.0 - 19/10/2022

				
					(ip.geoip.country in {"BR" "CN" "EG" "HU" "IN" "ID" "MY" "RO" "RU" "TW" "TR" "NP"})

V2.0 - 19/10/2022

				
					(ip.geoip.country in {"BR" "CN" "IN" "ID" "MY" "RO" "RU" "TW" "TR" "HU"})

V1.0 - 23/08/2022

				
					(ip.geoip.country in {"BR" "CN" "IN" "MY" "RU" "ID"})

(ip.geoip.country in {“BR” “CN” “IN” “MY” “RU” “ID”})

Changelog

Added:

Egypt
Nepal

Added:

Hungry
Romania
Taiwan
Turkey

Initial list created:

China
Brazil
India
Malaysia
Indonesia
Russia

How to block countries

How to know what countries to block with Cloudflare

Use the Wordfence dashboard widget on the website being attacked for reference.

Steps to block countries with Cloudflare

Login to Cloudflare
Go to firewall -> Firewall rules
Create a firewall rule and name it “Countries blocked from accessing website”
Under “When incoming requests match…” select:
Under field, select country
Under operator, select equals
Under value, add the country name to block
If you want to add more countries, select or at the end and repeat step 4
Next as a precaution, make sure not to block known bots from any country. To do this select and on the last country blocking rule and set::
Under field, select known bots
Under operator, select equals
Under value, set to off
Finally under “then”, select block to block these requests