caddy: block vuln-scanner probe paths (no-PHP/WP stack) → 403, not the SPA shell

Path-only @junk matcher on upbeatbytes.com (*.php, /wp-*, /.env, /.git, /phpmyadmin, /vendor, etc.) returns 403 instead of falling through try_files to a 200 SPA shell. Never matches by User-Agent, so real users + Googlebot/Bing are untouched. Applied to the live Caddyfile (validated + reloaded) and mirrored into the repo snapshot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-30 10:11:57 -04:00
parent 86d9897113
commit 27022108b4
33 changed files with 10 additions and 0 deletions
@@ -46,6 +46,16 @@ upbeatbytes.com {
 	encode gzip zstd

 	# Drop vuln-scanner probes for stacks we don't run. We're a SvelteKit SPA + FastAPI:
+	# zero PHP, no WordPress, no exposed dotfiles — so these paths can NEVER be a real
+	# user or a wanted search crawler (matching is path-only, never by User-Agent, so
+	# Googlebot/Bing are untouched). Without this they fall through try_files to the SPA
+	# shell and get a 200; now they get a clean 403 (still logged, so probes stay visible).
+	@junk path *.php /wp-admin* /wp-login* /wp-includes* /wp-content* /wp-json* /xmlrpc.php /.env /.env.* /.git /.git/* /phpmyadmin* /pma* /myadmin* /dbadmin* /vendor/* /.aws/* /.ssh/* /cgi-bin/* /administrator/*
+	handle @junk {
+		respond 403
+	}
+
+	# Retired prototype routes (promoted/removed at the news relaunch) → the hub.
 	@oldhome path /home2 /home2.html /home3 /home3.html
 	handle @oldhome {
 		redir https://upbeatbytes.com/ permanent