Hacker News Reader

If you're behind CloudFlare apparently they'll cover you, issue is, some people don't have their web servers configured to block traffic NOT from CloudFlare, so it is kind of a bandaid that's falling off I guess.

View on HN

I'd check this carefully and make sure you have the WAF enabled. I seemed to always have plenty of weird looking PHP and WP requests happily forwarded by CloudFlare to my servers.

Users on the Free plan have access to the Cloudflare Free Managed Ruleset, a subset of the Cloudflare Managed Ruleset.

https://developers.cloudflare.com/waf/get-started/

The only PHP project I had running I took down, it was literally just a web UI for my SQL databases on said box, which wasn't really full of anything meaningful, just old old Discord chatbot logs from forever ago, but still didnt want someone scraping those, so I removed php from the box entirely, I didnt even have a domain for the box so not super worried.

Everything else I use is not on PHP.

Reply on news.ycombinator.com