ProbeGuard records 404 requests and, when a single IP exceeds a configurable threshold within a time window, adds a Cloudflare IP Access Rule for that address. The rule is removed automatically when the block duration expires. Access Rules are available on every Cloudflare plan, including Free.

Because the block happens at Cloudflare, abusive traffic stops before it reaches PHP.

Features

Configurable threshold, time window and block duration
Repeat offenders are re-blocked on their next 404 and each block lasts twice as long, up to a configurable ceiling
Choose Block, Managed Challenge or Interactive Challenge for abusive IPs
Blocks are placed by a scheduled task, never during the visitor’s request
Anchored whitelist with wildcard support, matched against path, query string and host
Status screen with top offenders, recent 404s, active blocks and recent warnings
Optional email notification when an IP is blocked
Automatic pruning of 404, block and diagnostic records
Cloudflare credentials are entered in the plugin settings, with the token masked once saved, or defined in wp-config.php instead

Visitor IP detection

CF-Connecting-IP is trusted only when the request reaches the site from a Cloudflare edge address; the range list is refreshed daily from Cloudflare's public endpoint. If the site sits behind an additional proxy or load balancer, list its addresses in this optional constant so forwarded headers are honoured:

define( 'EDGE404_TRUSTED_PROXIES', '10.0.0.0/8, 203.0.113.7' );

Otherwise a request is attributed to the address it actually connected from, which cannot be forged. Private and reserved addresses are never sent to Cloudflare as block targets.

External services

This plugin communicates with the Cloudflare API at api.cloudflare.com:

Creating, listing and deleting IP Access Rules sends the offending IP address, the rule mode, an expiry note, and the configured zone ID. This happens when an IP crosses the block threshold, when a block expires or is removed manually, and when the Cloudflare block count is displayed in the admin.
A daily request to https://api.cloudflare.com/client/v4/ips refreshes the list of Cloudflare edge ranges. It sends no site or visitor data and requires no credentials.

Cloudflare’s terms of service (https://www.cloudflare.com/terms/) and privacy policy (https://www.cloudflare.com/privacypolicy/) apply.

ProbeGuard 404 Firewall for Cloudflare

External services