YTMP4 STATIC SITE — CLOUDFLARE CACHE, 404 AND WAF GUIDE
======================================================

A. MAKE THE ORIGIN RETURN A REAL 404
------------------------------------
The ZIP includes a root .htaccess for Apache/LiteSpeed:
  Options -Indexes
  ErrorDocument 404 /404.html

For CloudPanel Nginx, follow nginx-404.conf.example. Add error_page and the
internal /404.html location at server level. Edit the EXISTING location /
block to use `try_files $uri $uri/ =404;`. Do not create a duplicate location /.

Test a random nonexistent URL. It must display the custom 404 page AND return
HTTP status 404 (not 200). You can verify with browser DevTools or:
  curl -I https://YOUR_DOMAIN/a-random-fake-path-404-test

B. CLOUDFLARE 404 RATE LIMIT (RESPONSE-BASED)
---------------------------------------------
In Cloudflare: Domain > Security > Security rules > Create rule > Rate limiting.

When incoming requests match (replace YOUR_DOMAIN with your actual hostname):
http.host eq "YOUR_DOMAIN" and http.request.method in {"GET" "HEAD"} and not (http.request.uri.path eq "/jkdon" or starts_with(http.request.uri.path, "/jkdon/")) and not (http.request.uri.path eq "/data" or starts_with(http.request.uri.path, "/data/")) and not starts_with(http.request.uri.path, "/.well-known/")

Enable custom counting expression / Increment counter when:
http.response.code eq 404

Suggested initial settings:
- Characteristics: IP
- Threshold: 12 requests
- Period: 1 minute
- Action: Managed Challenge
- Mitigation timeout: 10 minutes

This counts only requests that actually receive an origin HTTP 404. Because the
counter uses `http.response.code`, Cloudflare evaluates the response after the
origin responds and matching requests may bypass cache. The mitigation action
applies to subsequent requests matching the rule's request expression from
that IP, not just the nonexistent URL. Start with Managed Challenge, monitor
Security Events, and tune the threshold to avoid affecting shared networks.
Availability of response-based custom counting expressions depends on the
Cloudflare plan/rule configuration.

C. OPTIONAL COMMON-SCANNER PATH RULE
------------------------------------
Create a Custom WAF rule. Expression (static site only):
http.host eq "YOUR_DOMAIN" and (starts_with(lower(http.request.uri.path), "/.env") or starts_with(lower(http.request.uri.path), "/.git") or starts_with(lower(http.request.uri.path), "/wp-admin") or lower(http.request.uri.path) in {"/wp-login.php" "/xmlrpc.php" "/phpmyadmin" "/phpmyadmin/"})

Action: Block. Do not deploy this if you intentionally use WordPress or any
application on those paths. Keep /.well-known/ accessible for certificate
validation; the expression above does not block it.

D. CACHE STATIC HTML AT THE EDGE FOR ORIGIN-LOAD REDUCTION
---------------------------------------------------------
Create a Cache Rule for public GET/HEAD pages. Exclude /jkdon/, /data/ and
/build.php. Cache only successful public pages; use a Cache Response Rule or
appropriate origin/cache settings to avoid storing 404 and 5xx responses.
Keep admin/login/data uncached. Start with Edge TTL 1 day and purge after a
full rebuild/deployment. Cache rules reduce origin load only for content that
has been cached; they do not guarantee every request is served from cache.

E. VERIFY AFTER DEPLOYMENT
--------------------------
1. Homepage loads and header search submits to /search.html?q=...
2. Search results page reads the q parameter and displays matching posts.
3. Existing movie/category URLs return 200.
4. A fake URL returns the custom 404 page with HTTP 404.
5. Admin login and /data/ protections still work.
6. Deploy WAF rules in Log/Simulate mode first if available; inspect Security
   Events, then switch to Managed Challenge/Block after validating matches.

The admin Cloudflare WAF page only generates/copies expressions and setup
instructions. It does not connect to or modify your Cloudflare account.
