I use Cloudflare and configured it to block visitors from Singapore, including interactive challenges and Bot Fight Mode, but I'm still seeing traffic from there. The traffic appears to be affecting my AdSense account, which was suspended for five days. My site is hosted with Hostinger, and I'm testing Hostinger's CDN as well to see whether it can block the traffic more effectively, although I know running two CDNs is generally not recommended. Could the traffic be bypassing Cloudflare, or could it be bots using changing IP addresses? What's the best way to stop it?
2 Answers
Country-based IP blocking is not always reliable because bot traffic can come from constantly changing addresses, proxies, or compromised networks. It may help to review current abuse and threat-intelligence IP lists, then combine those blocks with firewall rules, rate limits, and bot challenges rather than relying only on a Singapore country rule.
First, make sure visitors cannot connect directly to your hosting server and bypass Cloudflare. Configure the origin firewall or web server to allow HTTP and HTTPS traffic only from Cloudflare’s published IP ranges. Also check that your DNS records do not expose the origin IP. If the origin is reachable directly, Cloudflare’s country blocks and bot protections can be bypassed completely.
How would I configure the server so that only Cloudflare’s edge IP ranges can reach it?