Do I Have This Right - Automated Cloudflare Thread / Reply Bot Blocking

[Anthony Parsons]

I allow guests to post threads and replies in certain forums, and whilst I block just about everything known to man at Cloudflare already, and other means, at times something automated can still slip through and I want to basically close, what I think, is the last hole in my strategy.

If I use this Security Rule:

(http.request.method eq "POST" and (http.request.uri.path contains "/add-reply" or http.request.uri.path contains "/post-thread" or http.request.uri.path contains "/post/") and not http.cookie contains "xf_user" and not http.referer contains "myptsd.com")

I just want to confirm whether I have the /create-thread and /add-reply correct so it blocks on a Managed Challenge automated spam. Why this last approach? Because I have had a few occasions where someone has use a valid ISP IP and spammed a hundred automated comments onto the site. Whilst they all endup in moderation from other rules, I would prefer automation can't do this to begin with, hence this final rule.

I added "and" logic to ensure it targets the right situations, excludes logged in users and added referrer mydomain to block direct bot posts.

Thoughts from the experts?

 

[Wildcat Media]

That's an interesting security rule--I'd never have thought of this.

I wonder if it would also help prevent spammers from posting in the forum after they have created an account. If the account creation is automated, wouldn't that by definition mean the posts they leave behind are automated as well, and not be entered via any of the forum's "post" or "reply" editors?

 

[Anthony Parsons]

Yer, if you took out the cookie, it would apply the same if they registered an account then tried automated spam. It would just become:

(http.request.method eq "POST" and (http.request.uri.path contains "/add-reply" or http.request.uri.path contains "/post-thread" or http.request.uri.path contains "/post/") and not http.referer contains "myptsd.com")

The referrer ensures the person is physically at your website, if my knowledge on this is correct.