Yes, our URL (website link) has changed

Some of you may have noticed that our website URL has changed from xyzulu.hosting to xyzuluhosting.com

For some time we have been watching the price of our domain name xyzulu.hosting climb well past $500 AUD per year, and we just can’t justify spending that much on a domain name when a .com costs just $23 per year. So, we’ve moved over to xyzuluhosting.com as of today. We will be redirecting traffic and emails sent directly to our support email address for at least 12 months more. In any case, if you notice the change, you can be assured nothing else is changing with our services.

Restrict access to only traffic from Cloudflare

After finding it confusing and difficult to find clear information on this, even after checking Cloudflare’s own documentation, I’ve decided to put this post together in the hope of helping others.

The issue:

You have a website you protect (among other things) using Cloudflare. However, it’s still possible for traffic to reach your website directly, ie going around Cloudflare. This is quite easy if you do manage to find out the IP address a website is running on.

Side point: Cloudflare offer solutions such as Cloudflare Access which allow you to have VPN level protection for your website (or a section of it if you choose). These are great solutions, but only work properly if you can ensure that ALL traffic is forced to go via Cloudflare (and the protection they offer).

The solution:

After wasting days with keywords like: cloudflare restrict access, lock down traffic to only Cloudflare, restrict access to only Cloudflare IP addresses etc etc.. I stumbled on this post: Stop Cloudflare bypassing on shared hosting unfortunately the title is not as intuitive as it could be, however the solution is excellent (bar one small technicality which I will explain later). And I quote:


With a very simple Cloudflare Worker, we can add a request header, a header that will be sent from the edge (any of Cloudflare’s 180+ data centers) to the origin (your server), and therefore won’t be visible to site visitors. As long as the header name and value are kept secret by the site admin, any requests not coming through Cloudflare will not have this header, and will therefore trigger a rewrite condition at the origin server, and be redirected back to, well, Cloudflare – where a Firewall Rule will block it.

The Cloudflare worker (taken from this recipe 18). You’ll need to configure the Cloudflare worker via your Cloudflare account. For most sites, this will be free.

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

/**
 * Send header to origin, allowing for
 * .htaccess to block requests
 * not coming from Cloudflare
 */

async function handleRequest(request) {
  // Make the headers mutable by re-constructing the Request.
  request = new Request(request)
  request.headers.set('Secret-Header', 'SeCrEt-kEy')

  return await fetch(request)
}

And then on your own website the following .htaccess directives (place them at the top of the file):

# Route visitors not coming from Cloudflare to, well, Cloudflare
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteBase /
	# Both the header and the value should be kept secret
	RewriteCond "%{HTTP:Secret-Header}" "!SeCrEt-kEy"
	# Uncomment and edit w/ IP of services such as certs, cron, Softaculous etc
	# RewriteCond "%{REMOTE_HOST}" "!^xxx\.xxx\.xxx\.xxx$"
	RewriteRule .* "accessdenied.php" [R,L]
</IfModule>

What these directives do is check every request to see if it has a request header named “Secret-Header” and whether its value does not contain the string “SeCrEt-kEy”. If the header does not exist, or does not contain the key, the request will be redirected to a non-existing URI named here “accessdenied.php”, (a fictitious, non-existing file) which must be added in a Firewall Rule.


/end quote.

This works wonderfully. The problem with the suggested firewall rule (at Cloudflare) is that it won’t be triggered if traffic comes in from somewhere other than Cloudflare.. makes it redundant/useless. So, well.. edit that yourself or find another solution if you wish to gracefully block traffic this way.

Conclusion:

While the concept of restricting access to IP addresses and/or blocking access to some (via .htaccess) is fairly well documented, using Cloudflare (and I do recommend it) makes some of this quite complex when wanting to restrict access to ONLY traffic via Cloudflare. The solution above is elegant in that it adds a header to each request (via Cloudflare Worker) and then the .htaccess file checks to make sure that header is present (ie did it come from Cloudflare), if not, traffic is blocked or redirected to a file of your choosing (or even a 404 if you wish). Sadly not enough airtime is given to this solution, perhaps due to the wrong keywords being used. Hopefully this post help with that.

PS If you wish to avail yourself of our services for things like this (securing your existing or new website, website hosting that ensures your site is always kept up to date and secure along with regular off-site backups (which we can automatically send to you each time) be sure to get in touch with us to find out more.

Google Official WordPress Plugin

Do you have a WordPress website? Google has just released an official plugin for WordPress. You should install this plugin now. It’s called Site Kit and as explained by Google, it will allow you to “Get insights about how people find and use your site, how to improve, and monetize your content, directly in your WordPress dashboard”

Please visit the following page to find out more and then install the plugin:

sitekit.withgoogle.com

Once you have this plugin installed you can probably uninstall all the other non official plugins you previously needed to work with Google products (analytics, search etc).

It’s great to see the big G helping out WordPress webmasters with an official plugin like this.