ProbeGuard 404 Firewall for Cloudflare

ProbeGuard records 404 requests and, when a single IP exceeds a configurable threshold within a time window, adds a Cloudflare IP Access Rule for that address. The rule is removed automatically when the block duration expires. Access Rules are available on every Cloudflare plan, including Free.

Because the block happens at Cloudflare, abusive traffic stops before it reaches PHP.

Features

• Configurable threshold, time window and block duration
• Repeat offenders are re-blocked on their next 404 and each block lasts twice as long, up to a configurable ceiling
• Choose Block, Managed Challenge or Interactive Challenge for abusive IPs
• Blocks are placed by a scheduled task, never during the visitor’s request
• Anchored whitelist with wildcard support, matched against path, query string and host
• Status screen with top offenders, recent 404s, active blocks and recent warnings
• Optional email notification when an IP is blocked
• Automatic pruning of 404, block and diagnostic records
• Cloudflare credentials are entered in the plugin settings, with the token masked once saved, or defined in wp-config.php instead

Visitor IP detection

CF-Connecting-IP is trusted only when the request reaches the site from a Cloudflare edge address; the range list is refreshed daily from Cloudflare's public endpoint. If the site sits behind an additional proxy or load balancer, list its addresses in this optional constant so forwarded headers are honoured:

define( 'EDGE404_TRUSTED_PROXIES', '10.0.0.0/8, 203.0.113.7' );

Otherwise a request is attributed to the address it actually connected from, which cannot be forged. Private and reserved addresses are never sent to Cloudflare as block targets.

External services

This plugin communicates with the Cloudflare API at api.cloudflare.com:

• Creating, listing and deleting IP Access Rules sends the offending IP address, the rule mode, an expiry note, and the configured zone ID. This happens when an IP crosses the block threshold, when a block expires or is removed manually, and when the Cloudflare block count is displayed in the admin.
• A daily request to https://api.cloudflare.com/client/v4/ips refreshes the list of Cloudflare edge ranges. It sends no site or visitor data and requires no credentials.

Cloudflare’s terms of service (https://www.cloudflare.com/terms/) and privacy policy (https://www.cloudflare.com/privacypolicy/) apply.