articles/2025/cloudflare-waf-block-php/

[giscus[bot]]

articles/2025/cloudflare-waf-block-php/

Webservers get hit by hundreds of thousands of requests to random (non-existing) PHP files. Previously I dealt with this on the server level, now I'm doing it directly within CloudFlare.

https://www.loopwerk.io/articles/2025/cloudflare-waf-block-php/

[petertwise]

This sounds like a nice concept to stop the type of abuse we are seeing.
But how does this not block legitimate requests like wp-admin/plugins.php or wp-login.php or the admin-ajax.php endpoint?

[kevinrenskers]

In my case it's simple because I don't have any PHP file at all :)

[petertwise]

Ah, so you are using this with a static site, or something that's not WP? That makes more sense.

[kevinrenskers]

Yeah I don't use PHP. But in your case, you could whitelist your IP address so you can still access these sort of files.