PhoenixKitWeb.Plugs.ProbeBlock (phoenix_kit v2.45.0)

Copy Markdown View Source

Answers scanner probes with a bare 404 before they reach the router.

Every public site is hit around the clock by scripts looking for leaked files and other stacks' admin pages — /.env, /.git/config, /wp-login.php, /phpmyadmin. A Phoenix app has none of them, but each probe still runs the session, CSRF and router work and fills the log with 404s. This plug ends those requests first, with an empty body.

It is a path match only: no database, no settings, nothing to configure for the common case. Paths under /.well-known/ always pass (ACME challenges, security.txt, app links).

Wiring

In the host's endpoint.ex, before Plug.Static and the router:

plug PhoenixKitWeb.Plugs.ProbeBlock

Options

  • :extra — more patterns to block: strings (a path prefix, matched case-insensitively) or regexes (matched against the path).
  • :except — patterns that must pass even though a default matches, e.g. except: [~r/\.php$/] for a host that really serves PHP.
  • :status — the response status. Default 404.

The defaults: dot-files at the root and below (/.env*, /.git, /.svn, /.hg, /.aws, /.ssh, /.DS_Store, /.htaccess…), WordPress paths (wp-admin, wp-login.php, wp-content, wp-includes, xmlrpc.php, wp-config), any *.php, phpmyadmin, cgi-bin, /vendor/phpunit, /actuator and /server-status.

Summary

Functions

probe?(path, block, except)

Whether path would be blocked by the compiled block / except lists. For tests and for a host checking its own extra / except patterns.

Functions

probe?(path, block, except)

@spec probe?(String.t(), [Regex.t()], [Regex.t()]) :: boolean()

Whether path would be blocked by the compiled block / except lists. For tests and for a host checking its own extra / except patterns.