Comment by giancarlostoro
16 hours ago
If you're behind CloudFlare apparently they'll cover you, issue is, some people don't have their web servers configured to block traffic NOT from CloudFlare, so it is kind of a bandaid that's falling off I guess.
I'd check this carefully and make sure you have the WAF enabled. I seemed to always have plenty of weird looking PHP and WP requests happily forwarded by CloudFlare to my servers.
Users on the Free plan have access to the Cloudflare Free Managed Ruleset, a subset of the Cloudflare Managed Ruleset.
https://developers.cloudflare.com/waf/get-started/
The only PHP project I had running I took down, it was literally just a web UI for my SQL databases on said box, which wasn't really full of anything meaningful, just old old Discord chatbot logs from forever ago, but still didnt want someone scraping those, so I removed php from the box entirely, I didnt even have a domain for the box so not super worried.
Everything else I use is not on PHP.
They only block most common attempts they have seen.
They can't cover you. Only proper fix is updating your server.