Rule Packs
Ready-made rules and gym routines, tested on real traffic.
FreeA blank rules page is a hard place to start. Rule packs are curated, versioned sets of rules, with gym routines for the clients they tag, that you install in one go from the Rules page.
In the packs
- Scanners and 404 probes: secret and source hunters (.env, .git, keys, backups), admin probes that miss, wordlist sweeps, and 404s across several of your sites. Only "not here" answers count, so a real WordPress admin is never tagged. Its routine makes scanners solve a proof-of-work puzzle before each page.
- PHP exploit attempts: PHPUnit eval-stdin, PHP-CGI argument injection, Ignition, ThinkPHP, web shells and server-file reads. One request is enough, and tagged clients get a 403 on every page.
- AI crawlers: training crawlers and answer engines by name (GPTBot, ClaudeBot, PerplexityBot and the rest), and the impostors probing under those names. Tags only.
- Spoofed and outdated browsers: clients whose user agent, TLS and client hints disagree, headless Chrome, and browsers years out of date. Waiting rooms and a thorough browser check for them.
- Scripts on sign-in and forms: curl, python-requests, Go and friends posting to sign-in, sign-up, password and contact forms, sign-in hammering, and repeated failed sign-ins (with Request Monitor).
Safe to install
Installing never sends anyone anywhere: the rules only tag, and the routines start switched off. Turn on what you like once you've seen what it would catch. Each rule remembers which pack and version it came from, so you can update to a new version and keep the rules you edited; uninstalling keeps anything you changed as your own.
Bring your own
Packs are tagged, so another add-on can ship a pack of its own.
Free, and no licence key needed.