Blocking an IP on Cloudflare takes a long time to take effect

I am using an .htaccess configuration file on my website.

When a user performs a certain action (like attempting SQL injection), I block the user’s IP through the .htaccess file.

Since I am on Cloudflare, the .htaccess denial of access for the IP does not work anymore. I assume Cloudflare overrides the access control (I am seeing the client’s IP, not Cloudflare’s).

To counter this, I am updating a custom rule on Cloudflare WAF to block the IP. Although the API call works, and it EVENTUALLY blocked the IP, it takes an average of 60 seconds for the block to take effect.

I have changed my Cache settings to No query string, and I have purged all cache files.

How do I speed up the Cloudflare block, OR allow my .htaccess block to take effect until Cloudflare blocks the IP?

Because you are not rewriting IP addresses. You should definitely do this and that would also make that feature work again.

You can’t. I would usually assume it’s faster than a minute, but it’s not necessarily instant either. If you need that, you best switch back to the Apache configuration.

@sandro Many thanks for the advice. I can see the user’s IP, and I write the correct IP into the .htaccess, but the .htaccess does not block it like it should.

Are you using mod_remoteip for that?

Yes, I am

Then it may be an Apache configuration issue. With that plugin, the right IP address should be used and also work for any address blacklists. Verify if your logs show the right address and clarify the issue with the block with Apache, if the right addresses are listed but the block does not work.

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.