How to block request from non-browser

Website, Application, Performance Security
1

What is the name of the domain?

ioconvert.com

What is the issue you’re encountering

I don’t know how to block request from non-browser (like postman, curl…)

What is the current SSL/TLS setting?

Off

What are the steps to reproduce the issue?

I previously saw some website that use cloudflare to block /challenge request from non-browser: That request is works fine on chrome when visit their website, but when I copy that request as curl, and paste it to cmd and run, I’ve blocked from cloudflare. That is a awesome feature but I dont know how to use it. I’ve enable “Bot Fight Mode”, create waf block Known Bots, but still not working

2

Create a WAF rule:
User Agent contains “curl”
or User Agent contains “postman”
or User Agent contains “Go-http”
or User Agent contains “little client”
etc., etc.,
Then Block

3

Hello,

This will not working if curl / postman set an normal User Agent in request headers. I want to block that case. So I cannot use WAF rule User Agent

4

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.