I'm a Wordpress freelancer and a while ago i started creating my own themes for clients, either forking from a default theme (like Twenty Twenty-Five) or occasionally creating something completely blank.
How do I ensure these are secure? If Twenty Twenty-Five gets updated, obviously my themes are not being updated. How do I keep on top of what needs updating?
I have a website that's getting a lot of traffic to URLs that aren't intended to be viewable pages, and having checked this on a couple of other wordpress sites I manage, it seems to be a default part of Wordpress.
The URLs in question are: https://mycustomdomain.com/page/N/
We're experiencing a lot of bot traffic going to those addresses and are not sure why.
To mitigate this I have:
- introducing a WAF rule in Cloudflare to block visits (http.request.uri.path wildcard r"/page/*")
- added nginx rules to return a 404 on those URLs
I'm also trying to look into where these are coming from and why the site in question is seeing so many visits to these URLs.
I put the Cloudflare rule in place this morning (2-3 hours before writing this) and according to Cloudflare the rule has been triggered 8,430 times since I created it!
AFTER MORE INVESTIGATION:
So I believe that the issue is being created somehow by pagination / query loop.
I have a query loop on the page which returns posts. The pagination block for this returns pages past the initial 10 with the following URL structure:
https://mycustomdomain.com?query-7-page=2
I don't know why this is the URL convention rather than:
Login