Comment by cube00
13 hours ago
I'd check this carefully and make sure you have the WAF enabled. I seemed to always have plenty of weird looking PHP and WP requests happily forwarded by CloudFlare to my servers.
Users on the Free plan have access to the Cloudflare Free Managed Ruleset, a subset of the Cloudflare Managed Ruleset.
The only PHP project I had running I took down, it was literally just a web UI for my SQL databases on said box, which wasn't really full of anything meaningful, just old old Discord chatbot logs from forever ago, but still didnt want someone scraping those, so I removed php from the box entirely, I didnt even have a domain for the box so not super worried.
Everything else I use is not on PHP.