---
title: Block PHP requests
description: Learn how to block traffic looking for .php vulnerabilies.
url: /kb/guide/block-php-requests
canonical_url: "https://vercel.com/kb/guide/block-php-requests"
published: 2025-11-03
last_updated: 2025-11-10
authors: DX Team
related:
  - /docs/security/vercel-waf/examples
  - /docs/security/vercel-waf/custom-rules
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---
<!-- docsgraph:related -->
## Related pages

> **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below.

- [Examples](https://vercel.com/docs/vercel-firewall/vercel-waf/examples?from=related) — Learn how to use Vercel WAF to protect your site in specific situations.
- [IP Blocking](https://vercel.com/docs/vercel-firewall/vercel-waf/ip-blocking?from=related) — Learn how to customize the Vercel WAF to restrict access to certain IP addresses.
- [Web Application Firewall](https://vercel.com/docs/vercel-firewall/vercel-waf?from=related) — Learn how to secure your website with the Vercel Web Application Firewall \(WAF\)
- [Firewall](https://vercel.com/docs/vercel-firewall?from=related) — Learn how Vercel Firewall helps protect your applications and websites from malicious attacks and unauthorized access.
- [Custom Rules](https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules?from=related) — Learn how to add and manage custom rules to configure the Vercel Web Application Firewall \(WAF\).
- [Suspicious Traffic in Specific Countries](https://vercel.com/kb/guide/suspicious-traffic-in-specific-countries?from=related) — Learn how to block traffic in specific geographical regions.
- [Blocking traffic from a specific IP address.](https://vercel.com/kb/guide/traffic-spikes?from=related) — Learn how to block traffic from a specific IP address.
- [Limit Abuse with Rate Limiting](https://vercel.com/kb/guide/limit-abuse-with-rate-limiting?from=related) — Learn how to protect your authentication endpoints against abuse.
- [Emergency Redirect](https://vercel.com/kb/guide/emergency-redirect?from=related) — Learn how to implement an emergency redirect without re-deploying your site.

Full cross-link map for this page: [/kb/guide/block-php-requests.graph.md](/kb/guide/block-php-requests.graph.md)
<!-- /docsgraph:related -->


It is a common security practice to block requests containing `.php` especially for websites that don't use PHP for reasons such as:

- **Preventing vulnerability scanning**: Attackers often scan websites for PHP files to find potential vulnerabilities. By blocking these requests, you prevent activities that look for common PHP vulnerabilities or outdated PHP applications.
  
- **Reducing noise in logs**: If your application doesn't use PHP, blocking them reduces noise in your logs and makes legitimate issues easier to spot.
  
- **Stopping exploitation attempts**: Many automated attacks target common PHP vulnerabilities in applications like WordPress, phpMyAdmin, or other PHP-based CMS systems. If you don't use these technologies, blocking PHP requests immediately stops these exploitation attempts.
  

## Create a custom rule to block this traffic

1. Select your project from the Vercel [dashboard](/dashboard) and select the **Firewall** tab.
   
2. From the top right corner of the Firewall page, click the **Configure** button and then **\+ New Rule**.
   
3. Type "Block .php request paths" as **Name** and "Adds a rule that blocks any requests containing '.php'" as **Description**.
   
4. In the **Configure** section, set up the following **If** configuration:
   
   - If **Request Path** **Contains**.
     
   - Type `.php` in input box
     
5. Select **Save Rule**.
   
6. Apply the changes:
   
   - When you make any change, you will see a **Review Changes** button appear or update on the top right with the number of changes requested
     

- Select **Review Changes** and review the changes to be applied
  
- Select **Publish** to apply the changes to your production deployment
  

1. Observe the traffic for this rule on the Firewall overview page.
   
2. Update the rule's **Then** action to Deny and select **Save Rule** and apply the changes.
   
3. Review the live monitor. The traffic from that region should now be zero.
   

## Related

- [Suspicious Traffic in Specific Countries](/guides/suspicious-traffic-in-specific-countries)
  
- [Limit Abuse with Rate Limiting](/guides/limit-abuse-with-rate-limiting)
  
- [Emergency redirect](/guides/emergency-redirect)
  
- [WAF Examples](/docs/security/vercel-waf/examples)
  
- [WAF Custom Rules](/docs/security/vercel-waf/custom-rules)