Defender Pro Network-Level Blocking

0

I’m interested in implementing a query string on Defender block pages, such as adding “?blocked=1” to the URL, and then leveraging Cloudflare for further actions. Currently, I have this configuration in place successfully through a different security plugin. In the settings of the other plugin, I’ve designated “?blocked=1” as the redirect page. This setup ensures that whenever a banned offender attempts to access any page, this parameter is appended to the URL, enabling network-level blocking.

Furthermore, I’m exploring the possibility of directly synchronizing blocked IP addresses with Cloudflare’s API. One approach to achieve this could involve utilizing tools like fail2ban or similar methods. This would enhance the efficiency of managing and blocking unauthorized access at the network level. I would appreciate any insights, recommendations, or suggestions you might have regarding this integration.

  • Nithin Ramdas
    • Support Wizard

    Hi Abdullah ,

    As of now, the plugin does not support the specified workflows you have mentioned out of the box. I am currently checking with our developers to determine if there are any specific suggestions that can be provided for such use cases.

    Will keep you posted once we get further feedback asap.

    Best Regards,
    Nithin

  • Nithin Ramdas
    • Support Wizard

    Hi Abdullah ,

    I did check this further with our Defender team and I’m afraid the workflows you are looking to achieve aren’t possible via the plugin side at the moment. There aren’t hooks present on the plugin side, especially for such actions.

    Could we know via which security plugin you have placed the mentioned query string so that we could have a better idea regarding its workflow and check if the plugin could be improved in future updates regarding such a setup.

    Best Regards,
    Nithin

  • Abdullah
    • WPMU DEV Initiate

    Hi Nithin Ramdas ,

    The plugin is “Blackhole for Bad Bots” and as the name suggests, its scope is limited. It’s great at blocking bad bots only, but I took it one step further.

    The workflow is simple and easy. Go to the plugin settings and add your redirect parameter, in my case I used “?b=1”.
    [attachments are only viewable by logged-in members]

    Any link the bad bot visits will be blocked by Cloudflare. I know it’s not perfect but it’s enough to confuse them and save some server resources.
    [attachments are only viewable by logged-in members]

    This is how to set it up in Cloudflare. Go to WAF custom rules and follow the screenshot.
    [attachments are only viewable by logged-in members]

    In the next post, I will share what I did on another plugin but this time using the help of Defender.

  • Abdullah
    • WPMU DEV Initiate

    The second plugin, “BBQ Firewall”, created by the same developer, effectively blocks common paths and requests from sniffers. Unlike the previous plugin, it doesn’t ban them. Additionally, the blackhole URL cannot be used as a blocking end-point because of its nonce requirement. I communicated with the developer, who was open to the idea of combining the plugins.

    [attachments are only viewable by logged-in members]

    Meanwhile, I enabled a feature in the Defender firewall labeled “404 Detection”. I added a new folder to the Blocklist called “backup” and directed blocked traffic from BBQ to this location, resulting in their ban—a pleasing result.

    [attachments are only viewable by logged-in members]

    Moreover, as the blackhole employs a query to trap malicious bots that are explicitly prohibited in both the robots.txt file and the anchor tag, I purposely used “backup” to attract not only rogue bots but also inquisitive individuals.

    [attachments are only viewable by logged-in members]
    <a rel="nofollow" style="display:none" href="https://mywebsite.com/?backup=53136b0b5a" title="Do NOT click on this link or you will be banned from the site!">Don't Click</a>

    Circling back to the initial topic, it’s my wish that Defender provided more customization capabilities for its block page. It’s surprising that even the “custom message” eliminates any HTML input. My objective here is to integrate the hidden bot trap to bolster security, directing these bots into a spiraling blackhole.

  • Nithin Ramdas
    • Support Wizard

    Hi Abdullah

    Thanks for providing further details. Seems like most of these features highlighted for the Blackhole plugin are part of its Pro feature, so I couldn’t fully go through its workflow, however, your screenshots do help.

    I’ll make sure to bring this further to our Defender team’s attention to check and see what further improvements that could be looked at in the plugin side down the roadmap.

    We truly appreciate your feedback regarding this.

    Best Regards,
    Nithin