Getting random bots attack 404

[PC_Repair]

Can anyone give me a setting where I can block

wordpress/wp-includes/ms-blogs.php
skin/common_files/lib/jquery.cookie.js
wp-content/themes/car-repair/tinymce/inc/php/d7pvwm.php
blog/wp-includes/wlwmanifest.xml
wordpress/wp-includes/Text/Diff/Engine/shell.php
wordpress/wp-includes/ID3/module.audio-video.quicktime.php
/wordpress/wp-includes/kses.php

anyways I can block those using Cloudflare or .htaccess?

[sdayman]

You can block these with Firewall Rules. A “URI Path Contains wordpress” would certainly stop most of those.

https://developers.cloudflare.com/firewall/

[PC_Repair]

have I done this correct?

[sdayman]

It should be OR instead of AND. It’s not going to be all three at the same time.

[PC_Repair]

Like this?

does this mean no one is able to access anything that has a URL path?

Wordpress

wordpress/wp-includes/ms-blogs.php << this will be blocked?

for this to work do I need to do anything else?

I see it working thank you

[PC_Repair]

Ok

What’s the best URL path to block on WordPress?

This is what I have so far
skin
wp-config
assets
wp-links
themes
CGI
fusion
Avada

[fritex]

@PC_Repair

best URL patch to block on WordPress

If I may suggest as similar topic recently, not exactly the URL patch, rather multiple measures to protect WordPress by using Cloudflare which could be find at the below post containing useful stuff:

What Request to Block in Firewall for Wordpress and Normalize URLs

That is a good question out there. I would say it cannot be stated as a general rule of thumb, as far as some WordPress websites do not have to use like POST or PUT (WP REST API, wp-json, plugins etc.), while other have to - just an example. You could try to block TRACE & TRACK for example. Or, if you could for example, limit HEAD, GET and POST for some specific IP or some similar scenario, where you protect your Website from bad bots, possible attacks, etc. in terms of security measurements. …