cPFence Cloudflare is indeed a fantastic solution, especially at the individual website level. However, solutions like cPFence (and similar server-level products) offer more robust protection. They operate directly at the server level, making them especially effective against IP probes that bypass Cloudflare by targeting the server's IP directly.
True, but you can also block all traffic except for Cloudflare IPs on port 80/443 with a firewall or web server configuration. This should actually be an option within Enhance, I created a feature request for it.
https://community.enhance.com/d/2085-site-level-option-block-all-ips-except-for-cloudflare-ip-ranges
cPFence In addition to IP probes, cPFence’s IPDB can also defend against port scanning and server-level DDoS attacks. This added layer of security helps prevent various threats that might otherwise go unnoticed by Cloudflare or similar website-level solutions.
I think you should be able to rephrase this statement. As I understand it, the cPFence's IPDB is just a database of IP addresses that are known bad actors. The feature doesn't defend against port scanning and DDoS attacks if the attacking IP is not in the IPDB, correct?
cPFence If cPFence is installed and no initial smart or full scan is conducted, it won’t be aware of pre-existing infected files, as it only monitors newly added, changed, or modified files. That’s why we strongly recommend running an initial scan to catch any potential threats.
Thanks, so you're effectively scanning on-demand files only when newly added, modified and changed. Good to know.
