{
	"action": "block",
	"description": "Block irrelevant secret, development and WordPress probes",
	"enabled": true,
	"expression": "(lower(url_decode(http.request.uri.path, \"r\")) in {\"/wp-login.php\" \"/xmlrpc.php\" \"/edit-comments.php\" \"/wp-config.php\" \"/phpinfo.php\"} or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.env\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.env.*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.env/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.git\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.git/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.claude\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.claude/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.vscode\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.vscode/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.aws\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"*/.aws/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"/wp-admin\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"/wp-admin/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"/wp-content\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"/wp-content/*\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"/wp-includes\" or lower(url_decode(http.request.uri.path, \"r\")) wildcard \"/wp-includes/*\" or starts_with(lower(url_decode(http.request.uri.path, \"r\")), \"/@fs/\") or starts_with(lower(url_decode(http.request.uri.path, \"r\")), \"/@vite/\") or starts_with(lower(url_decode(http.request.uri.path, \"r\")), \"/vendor/phpunit/\"))"
}