ProbeGuard 404 Firewall for Cloudflare

WordPress plugin that records 404 requests and blocks or challenges abusive IPs at the Cloudflare edge using IP Access Rules.

Full documentation — features, setup, whitelist syntax, IP detection, retention, external services and changelog — lives in readme.txt, which is also what WordPress.org renders. The plugin's own Documentation tab (Tools → ProbeGuard 404 Firewall) mirrors it.

Quick start

1. Copy the plugin into wp-content/plugins/probeguard-404-firewall-cloudflare and activate it.
2. Create a Cloudflare API token with Zone → Firewall Services → Edit, scoped to the site's zone.
3. Paste the token and the zone ID into Tools → ProbeGuard 404 Firewall → Settings. The token is stored in a non-autoloaded option and only ever shown masked afterwards.
4. Configure thresholds on the same tab.

To keep credentials out of the database, define them in wp-config.php instead; the constants win over the stored values and the fields are then read-only:

define( 'EDGE404_API_TOKEN', 'your-cloudflare-api-token' );
define( 'EDGE404_ZONE_ID', 'your-zone-id' );

One further optional constant exists: if the site is behind an additional proxy in front of Cloudflare, define EDGE404_TRUSTED_PROXIES with the proxy addresses or CIDR blocks, or forwarded headers are ignored.

The plugin was called CF 404 Defender before 2.0.0. Its CF_404_API_TOKEN, CF_404_ZONE_ID and CF404_TRUSTED_PROXIES constants are still honoured, and tables, options and pending scheduled tasks are moved to the edge404_ names on upgrade.

Development

composer install          # PHP_CodeSniffer + WordPress Coding Standards
composer run lint         # php -l over every file
composer run phpcs        # coding standards

.gitlab-ci.yml runs both on every push, plus the WordPress.org Plugin Check ruleset.

License

GPLv2 or later.