Build maintainable rules that target attack patterns without blocking search engines or real visitors
You should be able to demonstrate the result described in the lesson and explain why each step was necessary.
Step-by-step
Start with logs
Look at actual request paths, countries, user agents, and managed-rule events before writing giant expressions.
Protect high-value paths
Give wp-login, wp-admin, XML-RPC, backup filenames, environment files, and common exploit probes deliberate treatment.
Use verified bots correctly
Do not accidentally block legitimate crawler traffic when applying country restrictions.
Rate-limit abuse
Repeated login attempts and expensive endpoints are often better handled with rate limiting than a permanent global block.
Test and stage
Use log or challenge actions where possible before making a broad block rule permanent.
You should be able to demonstrate the result described in the lesson and explain why each step was necessary.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.