[▲ Vercel Community](/) · [Categories](/categories) · [Latest](/latest) · [Top](/top) · [Live](/live) [Discussions](/c/community/4) # Vercel Firewall rules to deny bot attacks 270 views · 10 likes · 6 posts Earl (@earlrobb) · 2024-11-08 · ♥ 4 Have a small hobby Next.js 14 site. Sorting data I found 40,000 monthly 404's in the vercel **Usage** tab. Looking at the **Top Paths** it's obvious the site is being hit by bots trying to attack php files and wordpress directories. I have neither on the site. I am new to firewall management and was wondering if I could get some tips or improvements on what I have done? In **Firewall Rules** I have created 2 rules. RequestPath -> MatchesExpression ->\.php$|\.php7$|\.aspx$ RequestPath -> MatchesExpression ->(wp-content|wp-admin|wp-login|wp_content|wp_login|wp_admin|cgi-bin|wp-includes|wp_includes|wp-trackback|wp-feed) I did it this way because I noticed some bots were requesting /wp-content/ in the path without the php extension. Doing this I am able to deny approximately 1,000 requests a day. I am asking for feedback on what to block because on the hobby plan I can only see the top 1,000 paths in the Usage tab. I don't think there is any way for me to see a days worth of logs to look for attack vectors. The first 1,000 Top Paths is always flooded with php attacks because even though I am denying the requests they are still logged into Top Paths. Essentially, I cannot identify any attack vectors beyond PHP/Wordpress-based attacks to block. Are there other attack vectors I should consider denying? I denied the .aspx extension in the rules because, I though, surely there are bots attacking that extension. I have never seen it in the top paths though. Thx, earl Har (@harryyaprakov) · 2024-11-21 · ♥ 2 Thank you for the suggestion to use these rules! I have also been experiecing the same thing for more than a month. Wordpress, php and other probing requests in the thousands daily for multiple of my projects. I tried setting up the Attack Mode to see if it will help. I also found that some requests are for .sql and .env Will update if I find more. Aflah V P (@mysr-io) · 2024-11-21 · ♥ 1 I had a similar experience where bots were repeatedly hitting my website multiple times a day, assuming it was built with PHP or WordPress. Earl (@earlrobb) · 2024-11-25 · ♥ 1 Glad they of could be of help. its been a little over a month since I started blocking the php reuqests. The past few days have been really quiet, like 5 denied requests a day as opposed to 2,000. Aflah V P (@mysr-io) · 2024-11-28 @earlrobb did you added any new rules? Amy Egan (@amyegan) · 2025-04-28 · ♥ 2 We now have a new [Bot Protection](https://vercel.com/docs/bot-protection#bot-filter-managed-ruleset) feature and [Vercel Firewall templates](https://vercel.com/templates/vercel-firewall) to help with this. The new bot filter managed ruleset is currently in beta, so please share your experience in the feedback thread if you give it a try :slightly_smiling_face: https://community.vercel.com/t/feedback-thread-for-bot-filter-public-beta/9174