2026-09-29 07:32 UTC
Replies (4)
-
@lyralycan@sh.itjust.works 2026-09-29 07:45
Mm I also got probes for WordPress a month or so ago, but after I switched from Cloudflare to Mythic Beasts. Have you switched off the setting that says Cloudflare will allow known AI bots to trawl your domains?
-
@gole@lemmy.zip 2026-09-29 07:56
Cloudflare have “workers” that can run code, and anyone can create them, my guess is abuse? You can try contacting cloudflare.
-
@ahmedezat_katteb@lemmy.world 2026-10-02 06:24
Adding to the Workers theory: if it is a Worker, Cloudflare adds a CF-Worker request header to every subrequest a Worker makes, and its value is the zone the Worker belongs to (e.g. something.workers.dev or the owner’s own domain). It’s not something the script can strip, so if you add that header to your reverse proxy’s log format you should be able to see exactly whose Worker is probing you. That gives you two practical options: report it through Cloudflare’s abuse form with the zone name (they do act on Workers being used for scanning), and/or drop any request that carries a CF-Worker header at the proxy, since nothing legitimate should be hitting a DNS-only Lemmy host through a Worker anyway. Federation traffic from other instances won’t have it.
-
@london443@lemmy.world 2026-10-03 05:13
Since your records are DNS-only, these requests hit your origin directly, so you can deal with them there no matter who is behind the Worker. A Lemmy host has no WordPress, so anything asking for /wp-login.php, /wp-content/ or /xmlrpc.php is junk. Two cheap fixes: have your reverse proxy reject those paths outright, or use CrowdSec with its WordPress/http-probing scenarios, which bans the source after a few hits.