Hacker News Reader

How do you handle requests with obvious malicious intend like „/wp-admin/„ on a Java service?

Do you ignore these kind of mass/spam requests? Do you block those requests? I‘m curious.

The usual answer is your WAF blocks them and then you write a report counting it in the cyber attacks blocked by the WAF, proving it saved the company.

That sounds like hell, not sure if should count this as „blocked“ or more as a „I ignore them, but I need follow enterprise BS policy so they end up blocked“

Your application should be able to handle requests nearly as fast as a WAF. If your app is very slow to serve a 404 page, you'll want to fix that.

I count this as „I ignore them“

Reply on news.ycombinator.com