Block rogue PHP/WordPress scanner traffic with 410 Gone

[Copilot]

The site receives sustained bot traffic scanning for PHP files and WordPress paths (e.g. /wp-admin/..., /wp-includes/..., *.php) that are never valid on this SvelteKit site.

Approach

Returns 410 Gone — rather than a full SvelteKit 404 render — for requests matching known rogue patterns. 410 signals permanent absence to well-behaved crawlers, discouraging retries, unlike 404 which implies transience.

Changes

• src/hooks.server.ts — short-circuits the handle hook with a bare 410 response for:
  • File extensions never served by this site: .php, .asp, .aspx, .cgi
  • WordPress-specific path prefixes: /wp-admin, /wp-includes, /wp-content, /wp-login

function isRogueRequest(pathname: string): boolean {
  if (BLOCKED_EXTENSIONS.some((ext) => pathname.endsWith(ext))) return true;
  if (BLOCKED_PATH_PREFIXES.some((prefix) => pathname.startsWith(prefix))) return true;
  return false;
}

// In handle:
if (isRogueRequest(event.url.pathname)) {
  return new Response(null, { status: 410 });
}

No third-party packages involved — pure SvelteKit middleware.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Block rogue traffic</issue_title>
<issue_description>Every now and then my website gets hammered with rogue request:

• /css/colors/blue/index.php
• /wp-includes/assets/index.php
• /1.php
• /wp-admin/css/colors/midnight/about.php
• /wp-includes/js/codemirror/index.php

These are just examples. There are many more requests like this.

I am hosting on Railway and would like to avoid using third party firewalls. What are my options to mitigate these types of requests in a way that the rogue bots don't keep trying?

You would need to think about options to mitigate this within the SvelteKit app or possibly with another service hosted on Railway. Can you do some research about the options I have?</issue_description>

<agent_instructions>Start with an overview of what the options are. I would like to avoid third party packages.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Block rogue traffic #1125

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[railway-app]

🚅 Deployed to the website-pr-1161 environment in maiertech

Service	Status	Web	Updated (UTC)
website	😴 Sleeping (View Logs)	Web	Mar 18, 2026 at 8:26 pm

[maiertech]

@copilot What's the advantage of returning a 410 instead of the default 404?

[Copilot]

@copilot What's the advantage of returning a 410 instead of the default 404?

A 404 Not Found tells crawlers the resource is missing right now but might exist in the future, so bots will keep retrying. A 410 Gone signals that the resource is permanently gone and will never exist — RFC 9110 says clients should not request it again and should remove any cached references to it. Well-behaved scanners that respect HTTP semantics will drop the URL from their rotation after a 410, whereas they'll keep hammering on a 404.

[maiertech]

Not pursuing this further.