Lessons Learned
Tracing and blocking webshell scanners with Cloudflare analytics and WAF rules
My static site returned thousands of 404s for PHP files it never had. How I traced the requests to scanner VMs with Cloudflare analytics, and the WAF rules that stop them.