ProbeGuard 404 Firewall for Cloudflare WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA GitLab

WordPress plugin that records 404 requests and blocks or challenges abusive IPs at the Cloudflare edge using IP Access Rules.

Full documentation — features, setup, whitelist syntax, IP detection, retention, external services and changelog — lives in readme.txt, which is also what WordPress.org renders. The plugin's own Documentation tab (Tools → ProbeGuard 404 Firewall) mirrors it.

Quick start

1. Copy the plugin into wp-content/plugins/probeguard-404-firewall-cloudflare and activate it.
2. Create a Cloudflare API token with Zone → Firewall Services → Edit, scoped to the site's zone.
3. Paste the token and the zone ID into Tools → ProbeGuard 404 Firewall → Settings. The token is stored in a non-autoloaded option and only ever shown masked afterwards.
4. Configure thresholds on the same tab.

To keep credentials out of the database, define them in wp-config.php instead; the constants win over the stored values and the fields are then read-only:

define( 'EDGE404_API_TOKEN', 'your-cloudflare-api-token' );
define( 'EDGE404_ZONE_ID', 'your-zone-id' );

One further optional constant exists: if the site is behind an additional proxy in front of Cloudflare, define EDGE404_TRUSTED_PROXIES with the proxy addresses or CIDR blocks, or forwarded headers are ignored.

The plugin was called CF 404 Defender before 2.0.0. Its CF_404_API_TOKEN, CF_404_ZONE_ID and CF404_TRUSTED_PROXIES constants are still honoured, and tables, options and pending scheduled tasks are moved to the edge404_ names on upgrade.

Development

composer install          # PHP_CodeSniffer + WordPress Coding Standards
composer run lint         # php -l over every file
composer run phpcs        # coding standards

.gitlab-ci.yml runs both on every push, plus the WordPress.org Plugin Check ruleset.

License

GPLv2 or later.